Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    N00b question : multiple networks behind firewall

    General pfSense Questions
    3
    9
    743
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fatalexception0e
      last edited by

      I wasn't quite sure where to put this. It's a combo of NAT and routing and firewalling…
      I'm working on my first pfSense box, and I can't seem to get it right. The firewall has a 172.16.0.0/30 link to a core switch. The core switch owns several subnets in the 10.x.x.x space. A laptop configured as the other end of the 172.16.0.0 link can get to the box, but nothing on the other networks can when the firewall is plugged in to the core. I added a firewall rule to allow 10.0.0.0/8 to * and I've poked around with outbound NAT, adding a rule for 10.0.0.0/8.

      Can someone either give me the settings I'll need or point me to the right how to type docs?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        So you have a transit network of 172.168.0/30 to the downstream router (your L3 switch)..

        What is the routing on this switch?  Why would he send traffic down the transit if this is a new setup?

        You are correct in the interface the transit network is connected to.. I assume your lan would have to allow for the downstream network.  But your outbound should auto kick in when you create the gateway and route for your downstream 10.x networks.

        You need to greate a gateway pointing to the 172.16.0.x address of the switch.. and then create route say hey to get to 10.0.0.0/8 talk to that gateway.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • F
          fatalexception0e
          last edited by

          I was just trying to hit the LAN address of the pfSense box. Since it is a connected network, the L3 switch doesn't need any extra config to hit it. If a laptop is configured with the switch's address, it can access the firewall fine. A ping from the switch to the firewall will only succeed if sourced from the interface the firewall is connected to. I believe I have put a gateway on the LAN interface and set a route to point 10.x.x.x to it, but it is hard to remember everything I've done. I'll see if I can get some more time to poke around in it.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            yeah which is exactly what I said you need to create a gateway on pfsense so it knows how to get to the downstream networks on your L3 switch (router)

            No you would not put in the LAN interface.. You would create a gateway under routing.  And then create routes to use this gateway.. None of which would be done on the lan interface itself.

            You just need to adjust the firewall rules o the lan interface to all the traffic you want to allow from the downstream networks.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • M
              marvosa
              last edited by

              Post a network map.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                ^ this never hurts.. Have never in my life seen posting of network layout get comments like oh why did you post that, we don't need that.. What a waste of time that was, etc.. :)

                But in this case it seems pretty simple setup.. So I will post it up for the OP.

                Do I have something wrong here? See attached.  Other than possible actual networks you have downstream of the L3 switch?

                networkmap.png
                networkmap.png_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • F
                  fatalexception0e
                  last edited by

                  Your diagram is pretty accurate. I think my trip up might have been that when I was trying to set the L3 switch as a gateway, I was doing that config on the LAN interface itself. Unfortunately I don't have a lot of time to work with this, as it is something of a side project. Thanks for helping point me the right direction; I just am sorry that I'm not able to get in and work with it much.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    "I was doing that config on the LAN interface itself. "

                    Which turns the lan into a "wan" from pfsense point of few and turns on natting, etc..  So then you had 2 wans and no lans ;)

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • F
                      fatalexception0e
                      last edited by

                      It looks like the gateway on the interface was my problem. I created a gateway by itself and set 10.0.0.0/8 to point to it; now I can get the the firewall from anywhere on my LAN. I also made sure all my networks are permitted in NAT. Now I just need to "get an outage window approved" (this is at home :-D) for testing.

                      Thanks!

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.