Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Vm-network conecting to home network

    General pfSense Questions
    2
    22
    1449
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      lars314 last edited by

      Hi Guys,

      I new with all this pfsense stuff, and it give me a headache… i tried a couple of times but what i do it want work :(

      what try to do:

      Home network 192.168.0.x (TP-LINK Archer C7 v1)
      Vm-network  10.0.0.x (LAN site of pfSense box)

      what i have is a server running esxi 6.0.x with a default setup pfsence box..

      WAN to my home network & my LAN with DHCP to 10.0.0.x

      on my LAN site i have client Win8.1 and everything is working the machine is able to go to internet..
      but i also have synology NAS on my home network with all my files and  i like to acccess this files with my vm-client...

      can you guys tell me what i have to do to get access to my files?

      i know i have to make a route, i tried did not work :(

      see attachment for network in vm

      i found kinda some topic...
      https://forum.pfsense.org/index.php?topic=142131.15

      1 Reply Last reply Reply Quote 0
      • curtisgrice
        curtisgrice last edited by

        The VMware part looks good. The thing your missing is that you need to disable NAT on pfSense.

        I looked up your TP-Link and it supports static routes so this is "easy". Here are some general steps:

        1. Disable NAT on pfSense
        2. Set a static IP on your pfSense "WAN" from your main network but outside your DHCP range.
        2. On the TP-Link add a route to 10.0.0.0/24 via the IP you set on pfSense WAN (assuming your only using 10.0.0.1-10.0.0.254)
        3. Add firewall rules to pfSense as needed to allow traffic from your main LAN to your pfSense LAN (10.0.0.0/24)

        I'm not sure about internet access for you pfSense LAN though as the TP-Link may not NAT the extra network. I would advise getting a physical pfSense router. That way you can have all the networks "on" that physical router and have full control over NAT. That's how I do it at home and just extend the all the extra networks into ESXi via VLANs.

        Slow code? Sounds like a good reason to buy more hardware!

        1 Reply Last reply Reply Quote 0
        • curtisgrice
          curtisgrice last edited by

          The other thing you can do, is run the Virtual pfSense router as your main router, then just use the TP-Link as an access point. the big downside to that is, if your ESXi goes down so does your internet/network. You have to setup auto-start for the pfSense router VM and be extremely careful about how you change settings.

          Slow code? Sounds like a good reason to buy more hardware!

          1 Reply Last reply Reply Quote 0
          • L
            lars314 last edited by

            @curtisgrice:

            The VMware part looks good. The thing your missing is that you need to disable NAT on pfSense.

            I looked up your TP-Link and it supports static routes so this is "easy". Here are some general steps:

            1. Disable NAT on pfSense
            2. Set a static IP on your pfSense "WAN" from your main network but outside your DHCP range.
            2. On the TP-Link add a route to 10.0.0.0/24 via the IP you set on pfSense WAN (assuming your only using 10.0.0.1-10.0.0.254)
            3. Add firewall rules to pfSense as needed to allow traffic from your main LAN to your pfSense LAN (10.0.0.0/24)

            I'm not sure about internet access for you pfSense LAN though as the TP-Link may not NAT the extra network. I would advise getting a physical pfSense router. That way you can have all the networks "on" that physical router and have full control over NAT. That's how I do it at home and just extend the all the extra networks into ESXi via VLANs.

            oke i try this thanks let you if it works :D

            1 Reply Last reply Reply Quote 0
            • L
              lars314 last edited by

              @curtisgrice:

              The other thing you can do, is run the Virtual pfSense router as your main router, then just use the TP-Link as an access point. the big downside to that is, if your ESXi goes down so does your internet/network. You have to setup auto-start for the pfSense router VM and be extremely careful about how you change settings.

              i want to but i know nothing about pfsense and if i …. it up i have no internet ... :'(

              1 Reply Last reply Reply Quote 0
              • L
                lars314 last edited by

                2. Set a static IP on your pfSense "WAN" from your main network but outside your DHCP range.

                Like?

                192.168.0.2 because my dhcp on my TP-link start by 192.168.0.100



                ![pfsense - NAT.PNG](/public/imported_attachments/1/pfsense - NAT.PNG)
                ![pfsense - NAT.PNG_thumb](/public/imported_attachments/1/pfsense - NAT.PNG_thumb)

                1 Reply Last reply Reply Quote 0
                • curtisgrice
                  curtisgrice last edited by

                  @lars314:

                  2. Set a static IP on your pfSense "WAN" from your main network but outside your DHCP range.

                  Like?

                  192.168.0.2 because my dhcp on my TP-link start by 192.168.0.100

                  One change. The "Default" gateway (TP-Link used the wrong term there) will be the IP you give pfSense.

                  TP-Link
                  Destination network: 10.0.0.0
                  Subnet mask: 255.255.255.0
                  "Default Gateway": 192.168.0.2

                  pfSense
                  WAN: 192.168.0.2
                  LAN: 10.0.0.1

                  So if you PC (192.168.0.101) sends a packet to a VM guest (10.0.0.101) it will go to the TP-Link (PCs default gateway) then to the pfSense then to the VM guest.

                  I almost for, make sure pfSense has a route to your 192.168.0.0/24 network as well. That said, pfSense SHOULD already have one due to having an interface in the 192.168.0.0/24 network (the WAN interface) but if things are not working, that's a good first thing to check.

                  Slow code? Sounds like a good reason to buy more hardware!

                  1 Reply Last reply Reply Quote 0
                  • L
                    lars314 last edited by

                    do i need to fil in upstreamgateway for my WAN en LAN 192.168.0.1 & 10.0.0.1 ??

                    1 Reply Last reply Reply Quote 0
                    • curtisgrice
                      curtisgrice last edited by

                      If I understand your question, yes. The pfSense WAN upstream gateway will be the TP-Link LAN address (192.168.0.1).

                      I hope your project is moving along well and let me know if you need anymore help.

                      Slow code? Sounds like a good reason to buy more hardware!

                      1 Reply Last reply Reply Quote 0
                      • L
                        lars314 last edited by

                        how about the ustream for my LAN 10.0.0.1 do i need that one 2 ?

                        1 Reply Last reply Reply Quote 0
                        • L
                          lars314 last edited by

                          oke did is what i did:

                          Wan: 192.168.0.3/24 -
                          upstream: 192.168.0.1

                          Lan: 10.0.0.1/24
                          Upstream: 10.0.0.1
                          DHCP: 10.0.0.100 t/m 10.0.0.254

                          when i try on my server go to internet i get the message DNS not be found.
                          but got no yellow mark on my network icon.. :) so that is a good thing..

                          can tell we close to internet :P

                          Edit: if i give my server fix ip with DNS 8.8.8.8 and 8.8.4.4 internet is working
                          but i can ping 192.168.0.1 but i cant ping 192.168.0.100 (my workstation)

                          if i use: Diagnostics /ping and ping 192.168.0.100 it works <– need firewall rule ?

                          1 Reply Last reply Reply Quote 0
                          • curtisgrice
                            curtisgrice last edited by

                            Looks good, just remove the Upstream: 10.0.0.1.

                            In your DHCP for the 10.0.0.0/24 network, you should have the default gateway listed as 10.0.0.1 also make sure you have DNS servers listed in there.

                            As for pinging, check your firewall logs. That will tell you if thats why its getting blocked. If it is showing as blocked, make sure you have your allow rules on both pfSense LAN AND WAN. If it gets out it still needs to get back in  ;)

                            When using the pfSense Diag. Ping tool, its important to select the from IP as the auto setting will choose the IP closest to the destination i.e. if your pinging 192.168.0.1 it will use 192.168.0.3 and not 10.0.0.1. This will cause it to bypass any firewall rules on the LAN (10.0.0.1) interface.

                            Slow code? Sounds like a good reason to buy more hardware!

                            1 Reply Last reply Reply Quote 0
                            • L
                              lars314 last edited by

                              oke status update:

                              removed the upstream on LAN and added DNS 8.8.8.8 & 8.8.4.4 and default gateway 10.0.0.1 under services/ DHCP Server / LAN

                              Server: can ping to 192.168.0.100 (with CMD of MS)

                              workstation: cant ping to 192.168.1.100 (with CMD of MS)

                              i think i need some help with where to make the rules  :-[

                              but we made some progress…. :D

                              --- off topic---

                              I resetted pfsense to factory default no worry i made a snap :P
                              and i found out that by default i able to ping both ways.. so was trying to found out why .... but did not find any.... :(

                              1 Reply Last reply Reply Quote 0
                              • curtisgrice
                                curtisgrice last edited by

                                @lars314:

                                Server: can ping to 192.168.0.100 (with CMD of MS)

                                workstation: cant ping to 192.168.1.100 (with CMD of MS)

                                What is 192.168.1.100? That's not in any of our mentioned/configured subnets.

                                So far I have:
                                TP-Link WAN: (DHCP? doesn't matter for this topic)
                                TP-Link LAN: 192.168.0.1/24

                                pfSense WAN 192.168.0.3/24
                                pfSense LAN:10.0.0.1/24

                                Server: ?
                                Workstation: 192.168.0.100/24

                                Slow code? Sounds like a good reason to buy more hardware!

                                1 Reply Last reply Reply Quote 0
                                • L
                                  lars314 last edited by

                                  Sorry is a typo needs to be 10.0.0.100

                                  10.0.0.100 vm cliënt Windows server 2012 R2 assigned by DHCP on LAN..

                                  And gived a fix ip to WAN of 192.168.0.3 stil outsite of my DHCP of my Home Network.

                                  Becauce 192.168.0.2 was used..

                                  1 Reply Last reply Reply Quote 0
                                  • curtisgrice
                                    curtisgrice last edited by

                                    ok so:
                                    TP-Link WAN: (DHCP? doesn't matter for this topic)
                                    TP-Link LAN: 192.168.0.1/24
                                    Has route to 10.0.0.0/24 via 192.168.0.3

                                    pfSense WAN 192.168.0.3/24
                                    pfSense LAN:10.0.0.1/24

                                    Server: 10.0.0.100/24
                                    -Gateway 10.0.0.1

                                    Workstation: 192.168.0.100/24
                                    -Gateway 192.168.0.1

                                    Server to Workstation - working
                                    Workstation to Server - not working?

                                    Can you show me your firewall rules on pfSense WAN and LAN?

                                    Slow code? Sounds like a good reason to buy more hardware!

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      lars314 last edited by

                                      Edit: Did some ping test with CMD and from the 10.0.0.1 network i'am able to ping all IP's on my home network…

                                      other way i'am not home to vm-network...

                                      do i need to turn on (see last attachment) i have read some thing about it but i didnt total understant it.... sorry still a noob  :-[
                                      ##############################################################################

                                      Under Firewall/NAT

                                      Port Forward // 1:1 // Outbound // NPt

                                      they are empty

                                      Here some screens

                                      hoop you can read them :)

                                      Sorry not sure on witch page to add the rule






                                      1 Reply Last reply Reply Quote 0
                                      • curtisgrice
                                        curtisgrice last edited by

                                        Under NAT outbound, this MUST be disabled. That's why you can ping from 10.0.0.0/24 to 192.168.0.0/24. NAT will see the ping on its way out and map 10.0.0.100 to 192.168.0.3:[some port number] (This is actually called port address translation.)

                                        If you ran a packet sniffer on 192.168.0.100 while pinging from 10.0.0.100, 192.168.0.100 would see the ping came from 192.168.0.3.

                                        When you try to ping from 1923.168.0.100 to 10.0.0.100 that port map does not exist and will be blocked.

                                        NAT (PAT - port address translation in most implementations) hides a network behind one or a set of IPs. This is why when you have a bunch of PCs connected to the internet you only get one public address. Your home router uses PAT to connect all of your devices to the internet and coincidentally that's also why you need port  forwarding to connect to your computers from outside of your home network.

                                        Long story short, disable NAT. Your rules look ok to me.

                                        Slow code? Sounds like a good reason to buy more hardware!

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          lars314 last edited by

                                          I did turn off the NAT function, but know i not able to ping like you sad.
                                          so think we need some Firewall rules ?

                                          My goal is to use MS WDS // MDT for study  :)

                                          1 Reply Last reply Reply Quote 0
                                          • curtisgrice
                                            curtisgrice last edited by

                                            Can you send screenshots for your pfSense routes, gateways, and dhcp? Also the static route on your TP-Link.

                                            Slow code? Sounds like a good reason to buy more hardware!

                                            1 Reply Last reply Reply Quote 0
                                            • L
                                              lars314 last edited by

                                              The requested img…




                                              1 Reply Last reply Reply Quote 0
                                              • curtisgrice
                                                curtisgrice last edited by

                                                Remove GW_LAN. Also on the DHCP on pfSense make sure the default gateway is set to 10.0.0.1

                                                Slow code? Sounds like a good reason to buy more hardware!

                                                1 Reply Last reply Reply Quote 0
                                                • First post
                                                  Last post