Configuring routing

mururoa

Hello,

I'm afraid I'm not a network expert :( More a cluster/virtualization admin)
I've installed pfsense (latest) in a vmware VM.
I want to use it only for internal firewalling and routing.
So my 'wan' subnet is 192.168.0.0/24 (admin network) and my lan subnet is 192.168.1.0/24 (data network).
I cant manage to configure pfsense as a router. I dont know if it related to firewall or routing configuration.
What I want to do is to configure pfsense as a gateway for then lan subnet.
I've configured the static route on the ESXs correctly. I can ping the lan IP of pfsense 192.168.1.1 from them.
But if I try to access the other VMs on the lan subnet the packets are not correctly routed.
Ie ping 192.168.1.1 –> ok
ping 192.168.1.12 --> 100% packet loss
But from pfsense ping 192.168.1.12 is ok ofc.
How can I setup that ?

johnpoz

"I've configured the static route on the ESXs correctly."

Not sure what that has to do with anything.. The VM hosts vmkern sits on your amdin network as your calling it 192.168.0/24

Your vms site on the vm host in a vm network 192.168.1/24 where pfsense has its wan interface in your 192.168.0 and its lan in 192.168.1 - out of the box in such network anything on 192.168.1. using pfsense as its gateway should be able to talk to 192.168.0 since pfsense would nat all that traffic to look like it came from its 192.168.0.x address.

If you want stuff on 192.168.0 to initiate traffic to 192.168.1 you would need to do port forwarding.

Now if you want to not nat at pfsense and only route/firewall then you would need to setup the correct routing on your 192.168.0 to use pfsense 192.168.0 as the route to get to the 192.168.1 network - or you would connect pfsense to your upstream router for this 192.168.0 via a transit, etc..

I have been running pfsense on esxi for many years.. Please draw up how you have this all connected together and be happy to help you get it working. But at a lost to what static route you would of created on the VM host?? In any situation..

mururoa

Routes on ESXs will be needed since the ESXs themself with have to talk to VM in the 192.168.1.0 network.
I cant configure the gateway of 192.168.0.0 since it's a cable modem with no configuration available for that.
The purpose of this config is to deploy ScaleIO (SDN) so the ESXs are clients of VMs of the 192.168.1.0.
They can join the 192.168.1.1 using 192.168.0.3 (pfsense lan and wan) but wont reach the servers on 192.168.1.0.
I guess I cant do port forwarding for that since a client will have to reach several servers to get the data.
Dont say I have to change my gateway for 192.168.0.0 :(

mururoa

On Linux it's as simple as :

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables --table nat --append POSTROUTING --out-interface ens224 -j MASQUERADE
iptables --append FORWARD --in-interface ens192 -j ACCEPT

ens224 is the interface on 192.168.1.0 and ens192 the interface on 192.168.0.0
Then on client just to add route to 192.168.1.0 using the ens192 address and that's all about it.
I should be somehow possible to do that on pfsense ?

johnpoz

"Routes on ESXs will be needed since the ESXs themself with have to talk to VM in the 192.168.1.0 network."

In what scenario? please draw up how you have this connected.. I have vms on a vm only network behind a pfsense and the vms… So your saying your vmkern on your esxi/vsphere host needs to initiate traffic from its vmkern on 192.168.0 IP to an IP... What sort of traffic is this?

Please draw up your network.

mururoa

This is something like that :

ESXs are both clients and servers for shared Data.
It's all about EMC ScaleIO SDN (Software Defined Network). This is a competitor to vmware VSAN.
The main advantage is that the client dont need to be an ESX but can be any Linux/Windows/vmare host. Same thing for the servers.
Pretty nice scale out SDN. So far the main concern is cost.

PS : the config is ok now using linux gateway and pfsense is now located on a ScaleIO SDN Datastore ;)