Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DMZ for VMs with VM pfSense

    Scheduled Pinned Locked Moved Virtualization
    32 Posts 5 Posters 5.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      luckyzor
      last edited by

      Hello,

      First of all I'm using CentOS 7 as Host of the VMs.

      I struggling on how to configure the 3rd network-interface (virtual?) for the VM pfSense and for the VM's to put in the DMZ.

      My server have 2 physical NIC, here my setup for now:

      Internet - ISP router with NAT ON - 192.168../24 WAN - NIC1 passthrough(macvtap) - VM-pfSense - NIC2 bridge(br0) - LAN - 10.... - VM's + Desktop + other devices OK

      What I wanted for, secure reasons, is to NAT (http / https / other services) in the ISP router -> VM pfSense -> DMZ

      My issue is to configure the network-interface between the VM-pfSense and DMZ so I can add the same network-interface to the VMs I want to the DMZ zone.

      I've tried to create a virtual-network with NAT to all devices, It worked but the VM in the DMZ zone "talked" with the VM in LAN(no rules/nat in the DMZ). I don't want that.

      Can anyone help me or give me other opinions (how to do it or if I really need to do it, for home server use)

      Thanks in advance
      Ivan

      V 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        @luckyzor said in DMZ for VMs with VM pfSense:

        What I wanted for, secure reasons, is to NAT (http / https / other services) in the ISP router -> VM pfSense -> DMZ

        Huh??

        Your isp is already natting... So using pfsense behind this is a double nat.. That is not any more secure than your first nat.. You want to put your "dmz" stuff behind pfsense and prevent it from talking to your normal network is my guess..

        Why do you need this 3rd network? You want something like this right?

        0_1541588894241_setup.png

        Where your VMs running on your host can not talk to 192.168.1/24 and you forward traffic on your isp router to 192.168.1.100 (pf wan IP) and then forward to 192.168.2.X your different vms on pfsense.

        If not then please draw up what your wanting to accomplish.

        BTW I would NOT do it that way... I would put everything behind pfsense both your physical network and your vm network(s) but hey thats just me..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        RicoR 1 Reply Last reply Reply Quote 1
        • RicoR
          Rico LAYER 8 Rebel Alliance @johnpoz
          last edited by

          @johnpoz said in DMZ for VMs with VM pfSense:

          I would put everything behind pfsense both your physical network and your vm network(s) but hey thats just me..

          Nope it's me too. ;-)

          -Rico

          1 Reply Last reply Reply Quote 0
          • V
            viragomann @luckyzor
            last edited by

            @luckyzor said in DMZ for VMs with VM pfSense:

            I've tried to create a virtual-network with NAT to all devices

            You have to create an isolated network instead. The NAT network bypasses your DMZ devices to the LAN.

            1 Reply Last reply Reply Quote 0
            • L
              luckyzor
              last edited by

              @johnpoz

              This is what I have for now:

              0_1541594905584_f45fdf7d-91e9-48d6-8c10-f6b741d34f9d-image.png

              And I wanted to isolate the VM-http, something like that:

              0_1541595196154_92f62cbd-cff4-4a74-ba30-69e9194ceba4-image.png

              About the NAT is not better NAT in the ISP router then only in the VM-pfSense?

              thanks for your help

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Well then your just creating another network and or vlan in pfsense on your vm host, its going to nat that auto just like it does for your 192.168.2 network. There is not reason for a another nic - a vnic sure, connect it to your vswitch in your vm software. Can connect your VMs to that vswitch.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                L 1 Reply Last reply Reply Quote 0
                • L
                  luckyzor @johnpoz
                  last edited by

                  @johnpoz said in DMZ for VMs with VM pfSense:

                  Well then your just creating another network and or vlan in pfsense on your vm host, its going to nat that auto just like it does for your 192.168.2 network. There is not reason for a another nic - a vnic sure, connect it to your vswitch in your vm software. Can connect your VMs to that vswitch.

                  My question is that, what network should I create?
                  Should I create in Virt-manager? if yes what? virtual network (which?)? network interface(wich?)?
                  Should I create a Vlan in pfSense? (any tips on how to do it?)

                  Which is better?

                  Can you give your personal opinion about my diagram? Just to know if something should change.

                  Thanks

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    What are you using for VM software - saying you use centos doesn't tell me what your running for VM.. Is it Virtualbox, OpenVZ, Xen, KVM, Linux-Vserver, Bochs? UML?

                    If you want a vm host - I for starters if you want a vmhost would just be using type 1 vs 2.. Say Esxi

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    L 1 Reply Last reply Reply Quote 0
                    • L
                      luckyzor @johnpoz
                      last edited by

                      @johnpoz said in DMZ for VMs with VM pfSense:

                      What are you using for VM software - saying you use centos doesn't tell me what your running for VM.. Is it Virtualbox, OpenVZ, Xen, KVM, Linux-Vserver, Bochs? UML?

                      If you want a vm host - I for starters if you want a vmhost would just be using type 1 vs 2.. Say Esxi

                      I'm using KVM/QEMU.

                      V 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        Well then RTFM on how to create vm network and attach it to a VM... That has zero to do with pfsense at all..

                        If I used KVM than I would be happy to point you how to do it - but other than maybe on some vps I have never used it.. I could fire it up I guess but have zero need currently.. Sorry.

                        If you switch over to say type one running esxi than be happy to help. Or running Virtual Machines on Synology NAS could point out exactly how to do it, which is what I am currently using and playing with.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @luckyzor
                          last edited by

                          @luckyzor
                          I've already tried to tell you to add an "isolated network".
                          Add a new virtual network in the VMM, enter DMZ in the network name box, no DHCP (if needed, this can be done by pfSense), no routes, check "isolated virtual network".

                          Then add a NIC to pfSense and connect it this network and configure it in pfSense. Also connect the virtual NICs of the other DMZ VMs to it.

                          L 1 Reply Last reply Reply Quote 0
                          • L
                            luckyzor @viragomann
                            last edited by

                            @viragomann I've done that but no internet access with the VM in the DMZ.

                            Maybe this need more configuration in pfSense... Can you give me some clue? Thanks alot

                            @johnpoz I've already thought to change to Exsi but I need to buy a license, and I have already all my VM in KVM. One day maybe :)

                            RicoR GrimsonG V 3 Replies Last reply Reply Quote 0
                            • RicoR
                              Rico LAYER 8 Rebel Alliance @luckyzor
                              last edited by

                              @luckyzor said in DMZ for VMs with VM pfSense:

                              I've already thought to change to Exsi but I need to buy a license

                              Depends on your Feature needs, there is a free ESXi License. You can't run vCenter with the Free and some other stuff is missing, you just need to check.

                              -Rico

                              1 Reply Last reply Reply Quote 0
                              • GrimsonG
                                Grimson Banned @luckyzor
                                last edited by

                                @luckyzor said in DMZ for VMs with VM pfSense:

                                Maybe this need more configuration in pfSense... Can you give me some clue? Thanks alot

                                https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html I guess you forgot to add rules to your new interface in pfSense. Hard to say unless you provide some more details.

                                L 1 Reply Last reply Reply Quote 0
                                • V
                                  viragomann @luckyzor
                                  last edited by

                                  @luckyzor said in DMZ for VMs with VM pfSense:

                                  Maybe this need more configuration in pfSense... Can you give me some clue?

                                  pfSense only permits access on LAN devices by default, on other interfaces added by yourself you have also to add filter rules to permit access to connected devices.

                                  Go to Firewall > rules > DMZ and add a pass rule and allow any from any source to any for testing. Restrict access later.

                                  L 1 Reply Last reply Reply Quote 0
                                  • L
                                    luckyzor @Grimson
                                    last edited by

                                    @grimson said in DMZ for VMs with VM pfSense:

                                    @luckyzor said in DMZ for VMs with VM pfSense:

                                    Maybe this need more configuration in pfSense... Can you give me some clue? Thanks alot

                                    https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html I guess you forgot to add rules to your new interface in pfSense. Hard to say unless you provide some more details.

                                    I've added the network interfaces, created the DMZ interface:
                                    0_1541602797254_e575f400-3c42-40ec-aecb-a695af0e17b0-image.png

                                    Now my VM in the DMZ can ping my lan but can't ping my wan.
                                    I tried to block from dmz to lan and it doesn't work:
                                    0_1541603039683_378b0848-c61d-4aae-88b4-7e1362477d2c-image.png

                                    What I want:
                                    DMZ can't see Lan devices
                                    Lan devices can see DMZ

                                    DMZ can see and be seen by WAN

                                    Can I access DMZ by hostname in the Lan interface?

                                    thanks for your help. I really appreciate.

                                    1 Reply Last reply Reply Quote 0
                                    • GrimsonG
                                      Grimson Banned
                                      last edited by

                                      Start reading here: https://www.netgate.com/docs/pfsense/book/firewall/index.html the rule you posted above shows pretty clearly that you lack the basics on how a firewall works.

                                      1 Reply Last reply Reply Quote 1
                                      • L
                                        luckyzor @viragomann
                                        last edited by

                                        @viragomann said in DMZ for VMs with VM pfSense:

                                        @luckyzor said in DMZ for VMs with VM pfSense:

                                        Maybe this need more configuration in pfSense... Can you give me some clue?

                                        pfSense only permits access on LAN devices by default, on other interfaces added by yourself you have also to add filter rules to permit access to connected devices.

                                        Go to Firewall > rules > DMZ and add a pass rule and allow any from any source to any for testing. Restrict access later.

                                        Can't access internet with that rule:
                                        0_1541603339877_f4987f98-56de-4a11-903c-0009bc4881a6-image.png
                                        0_1541603402207_5dad9b9a-94d7-4490-9958-dcc2f461b7e8-image.png

                                        1 Reply Last reply Reply Quote 0
                                        • V
                                          viragomann
                                          last edited by viragomann

                                          Your rule allows TCP only! Ping needs ICMP.

                                          L 1 Reply Last reply Reply Quote 0
                                          • L
                                            luckyzor @viragomann
                                            last edited by

                                            @viragomann said in DMZ for VMs with VM pfSense:

                                            Your rule allows TCP only! Ping needs ICMP.

                                            0_1541663321652_589b3071-c434-4d90-86dd-0f11bb31fc67-image.png

                                            Still the same.

                                            @Grimson I will read what you send me and try to understand this.

                                            I'm facing a problem more "urgent" and I hope do be guide on how to troubleshoot this so I can try to fix it.
                                            everything works (not the DMZ, but that is not urgent) as expected with my host and other VMs in the LAN side.
                                            For the first time I plugged-in a switch in the LAN physical interface and my desktop to the switch.
                                            Unfortunately, I can't get IP from the DHCP, tried to put a ip manually and nothing.
                                            I don't know where to start to check where is the problem.

                                            I really need some help for this. Hope you can help me. Thanks in advance

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.