(help request) ISP->pfSence->Cisco router

[onupf]

I'm trying to setup pfSense although not having luck.

Goal = ISP-> pfSense -> Cisco 3825 ( edited model )

ISP cable modem, arris sb6141.

pfSense, Dell R210ii,
-Eth0 DHCP from ISP
-Eth1 192.168.2.1/30

Cisco 3825
G0/0 192.168.2.2/30
G0/1 192.168.1.1/24

I can ping and connect to the pfSense web interface from /24.  Cannot access external IP's. PfSense can ping outside IP's from Wan interface.

I assuming this is a pfSense Nat issue, although I'm obviously missing something.

Any pointers?

Thanks!

[johnpoz]

So did you create route in pfsense to your downstream router network(s)..  So in such a setup pfsense lan 192.168.2/30 is your transit.. I take it you know that because of the /30 - nice to see…

Once you create the route pfsense should auto create the outbound nat for your downstream networks.

Also check your lan rules, it would default to allowing lan net as source, which would not include your downstream 192.168.1/24 network - so you would have to adjust that.  If you had changed your outbound nat from automatic then you would have to manually add your outbound nat for your downstream 192.168.1 network

[NogBadTheBad]

Is it a router or a switch ?

There's a 3845 Router and a 3850 switch.

[onupf]

@NogBadTheBad:

Is it a router or a switch ?

There's a 3845 Router and a 3850 switch.

My apologies, it's actually a 3825 router with a 3750 switch.  I mashed them together I guess. :o

@johnpoz:

So did you create route in pfsense to your downstream router network(s)..  So in such a setup pfsense lan 192.168.2/30 is your transit.. I take it you know that because of the /30 - nice to see…

Once you create the route pfsense should auto create the outbound nat for your downstream networks.

Also check your lan rules, it would default to allowing lan net as source, which would not include your downstream 192.168.1/24 network - so you would have to adjust that.  If you had changed your outbound nat from automatic then you would have to manually add your outbound nat for your downstream 192.168.1 network

I'm in the process of setting up another router testing environment to configure this offline.  The kids go crazy when you take down the network on a snow day…  I have a feeling it's something to do with the lan rules as you state. I didn't mess with that. New to pfSense, so it's one of those learning curves I have to work through.

[NogBadTheBad]

No worries :)

TBH I'd bite the bullet and just use pfSense + a vlan capable switch and remove the Cisco in the final state.

No need to configure it off line, connect it to your existing LAN via the pfSense WAN port..

Once you have it working remove the Cisco and reconfigure the WAN port on the pfSense router.

Firewall rules via ACLs on a Cisco are nasty once you start using pfSense.

[johnpoz]

Unless you have some actual reason for downstream router - just let pfsense route between your vlans.. Make it real easy to firewall that way, etc.

[onupf]

Sorry for the late reply. This is more of a gee-wiz thing I wanted to try.

I'm currently running a Cisco ASA although it's an older device that's showing it's age compared to appliance potentials like pfSense and Sophos. My Cisco devices maybe see 1-2 restarts a year and always because of configuration changes on my behalf. Granted it's an overkill for a home network, but I do this for a living as-well not to mention the equipment was free.

I did bypass the 3825 and ran pfSense as a standalone router for the time being. It's nice to see an actual graphical interface for a change. Setup couldn't get any easier.  I am noticing a slight delay in loading webpages although that could be anything and I haven't really tried to troubleshoot it at all.

Anyways, I'll definitely be going back to a Cisco router behind some type of IDS/IPS. Just personal preference over anything else I guess.