N00b question : multiple networks behind firewall
-
I wasn't quite sure where to put this. It's a combo of NAT and routing and firewalling…
I'm working on my first pfSense box, and I can't seem to get it right. The firewall has a 172.16.0.0/30 link to a core switch. The core switch owns several subnets in the 10.x.x.x space. A laptop configured as the other end of the 172.16.0.0 link can get to the box, but nothing on the other networks can when the firewall is plugged in to the core. I added a firewall rule to allow 10.0.0.0/8 to * and I've poked around with outbound NAT, adding a rule for 10.0.0.0/8.Can someone either give me the settings I'll need or point me to the right how to type docs?
-
So you have a transit network of 172.168.0/30 to the downstream router (your L3 switch)..
What is the routing on this switch? Why would he send traffic down the transit if this is a new setup?
You are correct in the interface the transit network is connected to.. I assume your lan would have to allow for the downstream network. But your outbound should auto kick in when you create the gateway and route for your downstream 10.x networks.
You need to greate a gateway pointing to the 172.16.0.x address of the switch.. and then create route say hey to get to 10.0.0.0/8 talk to that gateway.
-
I was just trying to hit the LAN address of the pfSense box. Since it is a connected network, the L3 switch doesn't need any extra config to hit it. If a laptop is configured with the switch's address, it can access the firewall fine. A ping from the switch to the firewall will only succeed if sourced from the interface the firewall is connected to. I believe I have put a gateway on the LAN interface and set a route to point 10.x.x.x to it, but it is hard to remember everything I've done. I'll see if I can get some more time to poke around in it.
-
yeah which is exactly what I said you need to create a gateway on pfsense so it knows how to get to the downstream networks on your L3 switch (router)
No you would not put in the LAN interface.. You would create a gateway under routing. And then create routes to use this gateway.. None of which would be done on the lan interface itself.
You just need to adjust the firewall rules o the lan interface to all the traffic you want to allow from the downstream networks.
-
Post a network map.
-
^ this never hurts.. Have never in my life seen posting of network layout get comments like oh why did you post that, we don't need that.. What a waste of time that was, etc.. :)
But in this case it seems pretty simple setup.. So I will post it up for the OP.
Do I have something wrong here? See attached. Other than possible actual networks you have downstream of the L3 switch?
-
Your diagram is pretty accurate. I think my trip up might have been that when I was trying to set the L3 switch as a gateway, I was doing that config on the LAN interface itself. Unfortunately I don't have a lot of time to work with this, as it is something of a side project. Thanks for helping point me the right direction; I just am sorry that I'm not able to get in and work with it much.
-
"I was doing that config on the LAN interface itself. "
Which turns the lan into a "wan" from pfsense point of few and turns on natting, etc.. So then you had 2 wans and no lans ;)
-
It looks like the gateway on the interface was my problem. I created a gateway by itself and set 10.0.0.0/8 to point to it; now I can get the the firewall from anywhere on my LAN. I also made sure all my networks are permitted in NAT. Now I just need to "get an outage window approved" (this is at home :-D) for testing.
Thanks!