Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    PfSense as main Firewall of the LAN

    Routing and Multi WAN
    2
    10
    1406
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      lfdominguez last edited by

      Hello, this is my first post. I am a network admin and put pfSense as main firewall in my network:

      WAN 1(Private)–--------------                                                ------------------ (Servers Net)
                                            |                                              |
      WAN 2(Internet)------------------------( pfSense )---------------------
                                            |                        |
      WAN 3(Private)----------------                          -----------------------------------------(Internal Net)

      I was configurated the server as:
      re1: Internal Net
      re2:  Servers Net
      re3: WANs

      Only WAN2 has internet, the others are connection with others branch of the company. The problem is that from the pfSense I have internet (by WAN 2) but from the servers Net dont work, i see the pfSense, but this dont do the routing to WAN 2, wish is the default gateway of pfSense, i don't know how to tell to pfSense that do the routing from Servers Net interface to WAN 2.

      The Network Address of re3 are configurated as Virtual IPs in Firewall, because I configure that in a VLAN method, but it seems that my Layer 2 Switch not support that and the ICMP ping works to the WAN routers but the communication don't, thanks and sorry for my bad english.

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        "i don't know how to tell to pfSense that do the routing from Servers Net interface to WAN 2."

        Well what are you outbound nats?  And what are you rules for server net interface?

        What do you have setup for your gateways?  Which one is default?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

        1 Reply Last reply Reply Quote 0
        • L
          lfdominguez last edited by

          I don't have NAT configurateds, i need that pfSense actuate as a gateway for the Servers, wich they have an Squid running to control de Internet connections, but the Internal Company Network has the pfSense as Gateway too, because for the others WAN it can go directly. The gateways

          Example of WAN routers address
          WAN1 - 192.168.1.1/24
          WAN2 - 192.168.2.1/24 (INTERNET)
          WAN3 - 192.168.3.1/24

          pfSense Address:
          WANS:
            1: 192.168.1.2/24
            2: 192.168.2.2/24
            3: 192.168.3.2/24
          Servers NET:
            1: 192.168.0.254/24
          Internal NET (where are the PCs of the employes):
            1: 10.0.0.254/24

          So the gateways of pfSense are 192.168.x.1 and the default is the 192.168.1.1 (Internet). I was configure pfSense as if the Internal NET access only to determinated IPs in the WANs 1 & 3 (not internet) go directly as pfSense gateway and to go to internet need the proxy in the Servers address (192.168.0.3).

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            So your not doing nat?  So these wans are all internal networks, and should be transit networks not hosts on them..

            Can you draw your overall network up.  Why does pfsense have 3 wans??  If you want to use pfsense as some downstream router, then the only wan should be a transit, you could have multiple transits networks. But sounds like these are actual networks??

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

            1 Reply Last reply Reply Quote 0
            • L
              lfdominguez last edited by

              Two of the WANs are connections with a router with another instances of the company, only the WAN2 is used for internet. Transit Network?? i don't understand the mining of that. The network is exactly that i was posted

              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by

                You don't know what a transit network is?

                "So the gateways of pfSense are 192.168.x.1 and the default is the 192.168.1.1 (Internet)"
                "WAN2 - 192.168.2.1/24 (INTERNET)"

                So which one is it??  is 1.1 how it gets to the internet or is 2.1 how it does?

                So what network(s) are on the other end of this 192.168.3 network for example?  You say this is another router.. What networks are attached to that router, how does pfsense know how to get to those networks?

                What is the routing table of pfsense?  So this other router that pfsense connects to get to the internet is natting the networks behind pfsense.  Your not natting at pfsense you stated.  So you turned off natting??  Did you turn off firewall as well?

                This is basic networking 101, how is you don't know what a transit network is??  Are their any hosts on these 192.168.1 and .3/24 networks?  Why are they /24 if they are transit networks that only connect to another router with other networks connected to them?  So how do these other networks that are not your internet connection talk to each other?  How do they know to route to pfsense to get to your networks behind pfsense?


                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                1 Reply Last reply Reply Quote 0
                • L
                  lfdominguez last edited by

                  That's image is exactly that i have the network.

                  The .2.1 (INTERNET) is a router configurated by my ISP. The others two don't have internet and are routers to the other provinces with they endpoints to communicate with this branch.

                  WAN 1 is only to connect to us from another branch, this is a sub-branch, and the WAN 3 is where my main mail server are (all in the same address space).

                  Actually the routing table that i have is the automatically generated by pfSense and for test in the firewall I allow all the traffic from the servers net in all interfaces, but when in a server I execute "ping 8.8.8.8" never show nothing, it's seem filtered by pfSense

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by

                    So this router from your ISP is natting all these networks to your internet?  You said you turned off natting in pfsense.  So for you to ping 8.8.8.8 the isp router would have to nat your networks to whatever your public IP is.  And then the return that ISP router would need to know how to get back to that network.

                    "I don't have NAT configurateds"

                    So you turned off natting?  Or you just didn't configure it??  Out of the box pfsense would auto nat outbound traffic to its wan interface.  But if you have multiple wans then you need to make sure you nat correctly.

                    Please post up your outbound nat tab, and your routing table.  So what rules did you create on your interfaces that are not lan?  The default lan interface would be any any.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                    1 Reply Last reply Reply Quote 0
                    • L
                      lfdominguez last edited by

                      I didn't configure it (the NATs gg)… another problem is that the interfaces, the wan routers are connected to a optional interface (opt1), pfSense have inside that these interfaces can be WAN??? or i need put the routers WAN to the interfaces that pfSense say to me, i can't change it??

                      The ping to 8.8.8.8 inside pfSense is working great, the problem is outside... in the servers net.

                      The interfaces are:

                      EMPRESA Interface (wan, re1)
                      SERVIDORES Interface (lan, re2)
                      WAN_MAIN_INTERFACE Interface (opt1, re0) (INTERNET)
                      VLAN_NACIONAL Interface (opt2, re0_vlan1) (WAN 1)
                      VLAN_PROVINCIAL Interface (opt3, re0_vlan2) (WAN 3)

                      A question…. that the re1 (identify by wan) don't care that don't be attached to the INTERNET??? the main circuit must be:

                      EMPRESA -> SERVIDORES (SQUID) -> pfSENSE -> INTERNET
                      EMPRESA -> pfSENSE -> WAN 1 OR WAN 2 (services of my company in other areas)
                      SERVIDORES -> pfSENSE -> INTERNET

                      that's the flow that i want... thanks for all the reply

                      1 Reply Last reply Reply Quote 0
                      • L
                        lfdominguez last edited by

                        Well all works now, changing the cables to the correct interface… thanks

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post