Configuring routing

  • Hello,

    I'm afraid I'm not a network expert :( More a cluster/virtualization admin)
    I've installed pfsense (latest) in a vmware VM.
    I want to use it only for internal firewalling and routing.
    So my 'wan' subnet is (admin network) and my lan subnet is (data network).
    I cant manage to configure pfsense as a router. I dont know if it related to firewall or routing configuration.
    What I want to do is to configure pfsense as a gateway for then lan subnet.
    I've configured the static route on the ESXs correctly. I can ping the lan IP of pfsense from them.
    But if I try to access the other VMs on the lan subnet the packets are not correctly routed.
    Ie ping –> ok
        ping --> 100% packet loss
    But from pfsense ping is ok ofc.
    How can I setup that ?

  • LAYER 8 Global Moderator

    "I've configured the static route on the ESXs correctly."

    Not sure what that has to do with anything.. The VM hosts vmkern sits on your amdin network as your calling it 192.168.0/24

    Your vms site on the vm host in a vm network 192.168.1/24 where pfsense has its wan interface in your 192.168.0 and its lan in 192.168.1 - out of the box in such network anything on 192.168.1. using pfsense as its gateway should be able to talk to 192.168.0 since pfsense would nat all that traffic to look like it came from its 192.168.0.x address.

    If you want stuff on 192.168.0 to initiate traffic to 192.168.1 you would need to do port forwarding.

    Now if you want to not nat at pfsense and only route/firewall then you would need to setup the correct routing on your 192.168.0 to use pfsense 192.168.0 as the route to get to the 192.168.1 network - or you would connect pfsense to your upstream router for this 192.168.0 via a transit, etc..

    I have been running pfsense on esxi for many years.. Please draw up how you have this all connected together and be happy to help you get it working.  But at a lost to what static route you would of created on the VM host??  In any situation..

  • Routes on ESXs will be needed since the ESXs themself with have to talk to VM in the network.
    I cant configure the gateway of since it's a cable modem with no configuration available for that.
    The purpose of this config is to deploy ScaleIO (SDN) so the ESXs are clients of VMs of the
    They can join the using (pfsense lan and wan) but wont reach the servers on
    I guess I cant do port forwarding for that since a client will have to reach several servers to get the data.
    Dont say I have to change my gateway for :(

  • On Linux it's as simple as :

    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables --table nat --append POSTROUTING --out-interface ens224 -j MASQUERADE
    iptables --append FORWARD --in-interface ens192 -j ACCEPT

    ens224 is the interface on and ens192 the interface on
    Then on client just to add route to using the ens192 address and that's all about it.
    I should be somehow possible to do that on pfsense ?

  • LAYER 8 Global Moderator

    "Routes on ESXs will be needed since the ESXs themself with have to talk to VM in the network."

    In what scenario?  please draw up how you have this connected.. I have vms on a vm only network behind a pfsense and the vms… So your saying your vmkern on your esxi/vsphere host needs to initiate traffic from its vmkern on 192.168.0 IP to an IP... What sort of traffic is this?

    Please draw up your network.

  • This is something like that :

    ESXs are both clients and servers for shared Data.
    It's all about EMC ScaleIO SDN (Software Defined Network). This is a competitor to vmware VSAN.
    The main advantage is that the client dont need to be an ESX but can be any Linux/Windows/vmare host. Same thing for the servers.
    Pretty nice scale out SDN. So far the main concern is cost.

    PS : the config is ok now using linux gateway and pfsense is now located on a ScaleIO SDN Datastore ;)

Log in to reply