Setting up firewall for public networks
-
"I am also unable to ping the gateway IP from the VM"
How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)
What rules did you create on this new interface you created for your "192.168.158" I assume your just using rfc1918 space for your post - but its really public?
-
How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)
Pfsense is a physical server, both pfsense server and host of the VM is connected to the same switch
What rules did you create on this new interface you created for your "192.168.158"
A single rule that allows all traffic on ipv4 source any destination any (accept all rule)
I assume your just using rfc1918 space for your post - but its really public?
Yes, got a little confusing with all of the sets above. The last octet of the IP's are the same as what I'm using now so that I can keep track of what's doing. They are public
-
Well if your machines are VM then the switch that connects this vm network vswitch to your physical and then pfsense will have to be configured for your vlans yes…
So you have something like this (see attached pic)
You have to setup the vlans on your switch.. What VM are you using? esxi, vserver, xen, etc.? But for pfsense to be able to get the vlan on its physical interface you created the vlan on, then yes your switching environment has to be configured correctly to put the devices into the correct vlan on the switch port they are connected to. And then the connection to pfsense will have to tag these vlans so pfsense can see this traffic on its vlan interface you created.
-
Ah, I believe I've found the missing link then! I'm only going to the dc tomorrow to go reset our switch, if I fail we're purchasing a new one on Monday (the HP switch mostly runs Java which is so outdated it's not allowing for basic changes)
The diagram is also 100% correct.
For this particular VM test (as above) I used hyper-v but our production servers run citrix xenserver - These are the ones I am more interested in sorting.
Thanks for the help so far!
-
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule
This is backwards. Should be:
interface WAN with source Network 192.168.158.168/29 destination any and set the option to "Do not NAT" in the rule
I assume the 192.168 is simply a place-holder for the actual, public IP addresses. You can avoid this confusion there by using 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 in your examples where you want to use BS address space and want everyone to know you're really not talking about RFC1918 space. https://tools.ietf.org/html/rfc5735 (eta: oh already asked and answered. Not many people know about these example/documentation subnets so I'll leave it here).
