Make PFSense reach internet using private /30 subnet
-
Hi everyone,
I've succesfully installed our pfsense and set up routing/firewall rules and is everything working fine (traffic passing as expected).
This is my setup:
- LAN: /29 public subnet, PFsense using the first available ip on this interface to act as GW for all other machines
- WAN: /30 private subnet, my ISP using 172.25.10.1 and PFSense 172.25.10.2. The IP 172.25.10.1 is set as default gateway for the pfsense.
The problem with this setup is that PFSense is not able to reach internet itself, because it's trying to do using the private subnet. I need to install openbgp on this server but can't use the package manager.
Is there any static rule that I can create in order to bypass that limitation?
Thanks!
-
Why would you not be able to access the internet from that rfc1918 address - unless they are not going to nat that and just using it as transit for your /30
Your going to have to get with your ISP if your transit network can have internet access.. Would be my suggestion.
-
Why would you not be able to access the internet from that rfc1918 address - unless they are not going to nat that and just using it as transit for your /30
Your going to have to get with your ISP if your transit network can have internet access.. Would be my suggestion.
Yes.. they just as transit to my /30.
Here ir a traceroute from my pfsense box:
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 40 byte packets
1 172.25.10.1 (172.25.10.1) 5.270 ms 0.598 ms 0.410 ms
2 172.16.0.29 (172.16.0.29) 1.115 ms 0.886 ms 3.146 ms
3 * * * *
and from a regular machine:1 8 ms 6 ms 3 ms 186.XXX.XXX.XXX
2 76 ms 6 ms 7 ms 172.25.10.1
3 6 ms 7 ms 7 ms 172.16.0.29
4 6 ms 7 ms 7 ms 172.16.0.18
5 7 ms 7 ms 3 ms 172.16.0.26
6 20 ms 21 ms 20 ms 8.8.8.8 -
5 7 ms 7 ms 3 ms 172.16.0.26
6 20 ms 21 ms 20 ms 8.8.8.8You hit multiple hops of rfc1918 space and then BAM public 8.8.8.8 - that just makes zero sense completely.. Unless you were tied to the SAME DC that 8.8.8.8 actually sits..
-
Hi,
This happens because we're connected to IX-SP where Google announces this IP. It's a Layer-2 IX, so, this happens.
-
Can I create an outbound NAT to route the pfsense ip via a public ip address?
-
In order for your WAN to be able to access the internet either they will have to NAT for the private address you are using on your WAN (which is what they probably should be doing, absent what they REALLY should be doing - giving you real, routable IP addresses for your WAN interface).
You might be able to add an IP alias VIP from the /29 on your WAN interface and tell pfSense to outbound NAT certain traffic from the firewall outbound using that VIP. you will need to NAT at least DNS, HTTP, and HTTPS for package manager and updates to work I think.
It's a kludge but so is the configuration they gave you.
-
In order for your WAN to be able to access the internet either they will have to NAT for the private address you are using on your WAN (which is what they probably should be doing, absent what they REALLY should be doing - giving you real, routable IP addresses for your WAN interface).
You might be able to add an IP alias VIP from the /29 on your WAN interface and tell pfSense to outbound NAT certain traffic from the firewall outbound using that VIP. you will need to NAT at least DNS, HTTP, and HTTPS for package manager and updates to work I think.
It's a kludge but so is the configuration they gave you.
Perfect. I was able to download openbgpd with a config like the one that you referred.
