Proxmox + PFSense conection port forward
-
Huh?? If proxmox had an IP in this 192.168.1 network - he would have no need of creating any routes in the first place. when talking to 192.168.1.x it would use its IP in that interface.
If the HOST does not have an ip in this network, then he would need to route yes. But since pfsense is the router to get to 192.168.1 - and it nats this network out of the box.. He would have to setup port forwarding, and hit the IP of pfsense wan - so again no routing is involved.
-
its an optical cable modem. Huawei. Configs are default from isp (they burnt a customized firmware, that wont work with any other changes, really a s**t)
However, I did the nat, and it works when coming from other device on that modem.
192.168.100.1 - Isp modem DHCP
192.168.100.10 - Proxmox (vmbr0)
192.168.100.6 - PfSense (inside Proxmox - vmbr0) WAN
192.168.100.12 - external devicevmbr1 - inside PFSense LAN
192.168.1.1 - PFsense dhcp
192.168.1.100 - my vm with 4444 port openfrom .12 i manage to connect to the nat port forward at PFSense, lets say 192.168.100.6:4444
from .10 i cant connect to 192.168.100.6:4444 (i can see packages arriving in PFSense with CLOSED:SYN_SENT)
-
Well if devices on your network behind pfsense have firewall.. Pfsense can send the traffic to this IP all day long - doesn't mean that box will answer..
Here is the thing - sniff on pfsense lan interface in pfsense. Do you see it send the traffic on that you port forward? If so then pfsense did what its suppose to do.. If you get not answer that is nothing pfsense can do about that.
-
PFSense is a brand new installation , clean of rules, only the nat rule for that port is configured
Why it accpets from one device, and not from another (proxmox)?
-
You could have an issue in promox where your using the same interface to try and talk to itself just with another IP..
Sniff on pfsense - does it see the traffic to its wan IP, does it port forward it?
-
-
@johnpoz said in Proxmox + PFSense conection port forward:
If proxmox had an IP in this 192.168.1 network
No, it hasn't as I understood. It has only an IP in 192.168.100.x
-
So pfsense sent the SYN to you dest box - if it doesn't answer what is pfsense suppose to do? Does that dest VM have pfsense as its gateway? Does it have a firewall? Is it even listening on that port? Did it even see the traffic pfsense sent it?
-
Dear @johnpoz
When Promox communicate with 192.168.100.6 (pfsense) the packages seems to be arriving at PFSense, verified by states print above.
The dest VM 192.168.1.100 have pfsense as its gateway 192.168.1.1, and it is listening, I also confirm that because I can reach it from 192.168.100.12
vm dest does not have firewall enable, its a raw ubuntu server
-
I reach it from the same nat rule .. it works from 192.168.100.12, but not from 192.168.100.10 (proxmox).
-
Pfsense doesn't care what the source IP is.. I suggest again - you sniff.
On pfsense lan sniff when you send data from the .10 address. Do you see pfsense send the packet - do you get a response?
If your saying it works from .12, but not .10 - pfsense has no care what the source is - it would treat the data exactly the same.. Other than something in proxmox.
So sniff and see exactly what is going on..
