Is this a routing problem or something else? pfSense&OpenStack (SOLVED)

[johnpoz]

well depends..  Here is a question is your lan the default any any rule or did you modify or add some rules?  Did you mess with the outbound nat?  192.168.100 is not the default lan network.  So if you had changed your outbound nat to manual or something and didn't put it in right then you would have issues getting anywhere, etc.

[tsmalmbe]

the lan any-any is the default rule:
IPv4 * INTERNAL net * * * * none   Default allow LAN to any rule

there is also the dafult antilockout rule.

NAT - I have not changed. It is automatic.

[johnpoz]

so then if that is the case you should be able to ping the pfsense wan IP no matter what IP it is..  So look at your nat rules and make sure they show your 192.168.100 network..

And your floating rules tab is empty?

[tsmalmbe]

Affirmative on both - the network is in the NAT-list and there are no floating rules.

[johnpoz]

so your client at 192.168.100.6 can ping 192.168.100.5, what is the gateway on 192.168.100.6 box?  And you validated that 192.168.100.5 that your pinging and that your using as your gateway is actually the pfsense box via your arp table on the 192.168.100.5 box..

[tsmalmbe]

The settings regarding this I will have to triple-re-check.

[tsmalmbe]

For people in or from the future. This proved to be the solution:
https://ask.openstack.org/en/question/26980/problem-using-pfsense-vm-inside-a-tenant/
http://www.honnix.com/technology/software/cloud/network/2015/11/24/pfsense-as-router-in-openstack

The issue is how openstack works, not how pfSense works.

Openstack really is not click-drag-drop-works, it's a lot of overall fiddling and tuning (unless you just want one plain server directly on the internet).

[SoulChild]

I can't help but find running pfsense in openstack a bit… redundant. Maybe I'm missing something, but what exactly is wrong with using the many firewall layers of openstack that Neutron has built in?

I'm not saying there's no merit in this, but aren't you trying to solve a problem that openstack already has many tools to help you out? And surely, performance will suffer from the many overlay networks used.

[tsmalmbe]

Good question.

Openstack provides simple "port open or then not" -types of solutions whereas pfSense is a platform for building security.

Perhaps I have misunderstood OpenStack in this sense, but isn't it just iptables with a very very simplified interface on top?

[SoulChild]

You're right, but it just feels a bit weird implementing a virtual firewall on your openstack to access your virtual IP's

But god knows, openstack is the wild west so far as best practices are concerned, so don't let me tell you otherwise :D