Setting up firewall for public networks

mauzilla · Jul 26, 2017, 4:52 PM

Thank you Derelict! I've asked my colocation provider if they can confirm whether they can route the individual networks they give to us through a (new) /29 network with the first available network.

At this point of time I have the pfsense server plugged into the switch like other hosts so that I can start testing it over the private network which is making it a bit difficult to test your recommended ping scenario as the pfsense box does not have exclusive incoming access. I will however take your guidance on the matter as I've committed in getting this working (and glad I first came to ask before just trying!) I will keep you posted once I have an answer from them. I will also ask them to go ahead with a /29 order if they can confirm that they can do it as it sounds like that is the most logical route.

mauzilla · Jul 27, 2017, 9:24 AM

Got some feedback from our colocation provider. I'll paste their input. It appears that we have the option for routing:

–-----------------------------------------------------

There are two ways we can provision additional subnets to a client:

Configure the subnet with a default gateway in the VLAN (default)
Statically route the additional subnet to an IP in the existing subnet in the VLAN

I've tested last night the integration as described by John by setting up VIPs with a 1:1 ratio - This appears to work as well.

Based on the routing option, am I right in saying that an entire subnet would be routed to a single IP address which would then be the WAN IP in pfsense? If so, how does mapping happen as the devices behind the firewall would have a private IP? Would I still need to setup a 1:1 per private ip to one of the routed IP's in the subnet?

johnpoz · Jul 27, 2017, 9:37 AM

No you are not natting to a single IP.. Your devices behind would be on their public networks. There is no mapping..

If you want to all port 80 to some public IP behind pfsense, then you just put that rule in to the wan interface of the firewall..

mauzilla · Jul 27, 2017, 4:09 PM

So just to confirm:

1. I get a /29 from the datacenter and ask them to route all of our other networks through the first available IP.
2. I then setup the pfsense WAN with that IP
3. From there on forth I make incoming rules (on WAN) to allow the various ports on the public IP's. (so accept port 80 source any destination 196.123.123.123)
4. The VM's etc behind the firewall remains setup with their various static IP addresses, no network changes like changing the gateway to the lan required?
5. If I want to set rules for between the VM's making use of the public IP's behind the pfsense router, would I set them all in the WAN interface?

Thanks again for your help.

Derelict · Jul 27, 2017, 4:58 PM

No. You would number an inside interface (LAN) using one of the /26 networks. This would require firewall rules to allow outbound connections just like any other LAN.

The hosts on that network would get an address out of that /26 network (static or DHCP, your choice) and use the LAN address as their gateway.

You configure Firewall > NAT, Outbound on the WAN interface to NOT NAT for sources using that /26 network. (There are several ways to do this, I would use Hybrid mode and a NO NAT rule in your case.)

Then you just pass the desired traffic to the /26 on WAN. No port forwards needed. No NAT involved.

johnpoz · Jul 27, 2017, 5:13 PM

4 The vms would point to the IP of their gateway for their network that you put on the interface on PFSENSE.. So if if you got say a /24 of 196.123.123/24 that is routed to your wan IP. Then on pfsense interface that your going to connected your devices their gateway would be the IP you put on that interface - say 196.123.123.1

5 Pfsense has nothing to do with rules between devices on the same network.. Now if you have 2 networks behind pfsense like 196.123.123/24 and 196.123.124/24 then sure you could create filewall rules between these 2 different networks. But pfsense has nothing to do with devices on the same network talking to each other.

mauzilla · Jul 28, 2017, 7:39 AM

I've requested from the datacenter 2 additional /29 networks of which 1 will be routed through the first available IP in the other. I believe this will be the only way we can properly test this before going into production. Will try the below and keep you posted.

Thank you so far for your help!

Derelict · Jul 28, 2017, 9:18 AM

If they route the subnets it will work.

mauzilla · Jul 28, 2017, 12:16 PM

Got the routed IP's. It's 2 /29 networks where one routes to an IP within the other.

192.168.158.160/29 - 192.168.158.161 is the IP through which the following /29 is routed
192.168.158.168/29 (can use between 192.168.158.170 - 174)

Steps taken thus far:

1. I've then set the WAN to the 192.168.158.161, perfect, connected and VPN works!
2. I've created a VLAN (have not configured on switch yet) and a seperate interface which use static IP 192.168.158.170 (which would now also be the gateway for all other IP's in the usuable range)
3. I've created a WAN rule to allow for traffic from any source to 192.168.158.168/29 - This rule will be deleted, just want to first get the route and connection correct.
4. I've also setup a VM to make use of IP 192.168.158.171 and set the gateway to 192.168.158.170
5. I've created a LAN rule for the new interface in step 2 above for allow for all traffic - This rule too will be deleted / finetuned once the VM above has access
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule

At this point of time the VM setup in point 4 above has no internet access. I presume this is due to the VLAN not setup on the actual switch but only in pfsense? I am also unable to ping the gateway IP from the VM. I need to reset the switch directly at the datacenter so if the above may be due to the VLAN's not setup on the switch I'll need to first address that tomorrow.

johnpoz · Jul 28, 2017, 12:36 PM

"I am also unable to ping the gateway IP from the VM"

How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)

What rules did you create on this new interface you created for your "192.168.158" I assume your just using rfc1918 space for your post - but its really public?

mauzilla · Jul 28, 2017, 12:45 PM

How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)

Pfsense is a physical server, both pfsense server and host of the VM is connected to the same switch

What rules did you create on this new interface you created for your "192.168.158"

A single rule that allows all traffic on ipv4 source any destination any (accept all rule)

I assume your just using rfc1918 space for your post - but its really public?

Yes, got a little confusing with all of the sets above. The last octet of the IP's are the same as what I'm using now so that I can keep track of what's doing. They are public

johnpoz · Jul 28, 2017, 12:57 PM

Well if your machines are VM then the switch that connects this vm network vswitch to your physical and then pfsense will have to be configured for your vlans yes…

So you have something like this (see attached pic)

You have to setup the vlans on your switch.. What VM are you using? esxi, vserver, xen, etc.? But for pfsense to be able to get the vlan on its physical interface you created the vlan on, then yes your switching environment has to be configured correctly to put the devices into the correct vlan on the switch port they are connected to. And then the connection to pfsense will have to tag these vlans so pfsense can see this traffic on its vlan interface you created.

mauzilla · Jul 28, 2017, 1:31 PM

Ah, I believe I've found the missing link then! I'm only going to the dc tomorrow to go reset our switch, if I fail we're purchasing a new one on Monday (the HP switch mostly runs Java which is so outdated it's not allowing for basic changes)

The diagram is also 100% correct.

For this particular VM test (as above) I used hyper-v but our production servers run citrix xenserver - These are the ones I am more interested in sorting.

Thanks for the help so far!

Derelict · Jul 28, 2017, 6:34 PM

6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule

This is backwards. Should be:

interface WAN with source Network 192.168.158.168/29 destination any and set the option to "Do not NAT" in the rule

I assume the 192.168 is simply a place-holder for the actual, public IP addresses. You can avoid this confusion there by using 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 in your examples where you want to use BS address space and want everyone to know you're really not talking about RFC1918 space. https://tools.ietf.org/html/rfc5735 (eta: oh already asked and answered. Not many people know about these example/documentation subnets so I'll leave it here).