Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DMZ Basic Setup ???

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    6 Posts 3 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      joe4
      last edited by

      Can someone help me? I thought my setup was basic but it is having problems.

      pfsense
      WAN public ip
      LAN 192.168.100.1/24
      DMZ 10.10.10.1/24

      1:1 NAT
      server1 10.10.10.10 <–-public ip
      server2 10.10.10.11 <---public  ip

      Firewall rules
      WAN to LAN Block private
      DMZ to LAN Block all

      I can access the the webinterface on my server in the DMZ via http://10.10.10.10:8080 from the LAN.
      I can access the internet via the LAN

      My problem is everything in the DMZ cannot access the WAN (internet)
      They can ping other servers in the DMZ but not the gateway 10.10.10.1

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        Visit Firewall -> NAT -> Advanced outbouind nat. Turn it on.  Now duplicate the lan entry for the DMZ subnet.

        1 Reply Last reply Reply Quote 0
        • J
          joe4
          last edited by

          I copyed the one for the WAN, it was the only one there and changed the network address to my DMZ.
          Still not working.

          Do I need oubound firewall rules for the DMZ?

          1 Reply Last reply Reply Quote 0
          • H
            hoba
            last edited by

            How many public IPs do you have? You can't use 1:1 NAT twice with the same public IP. Also you need VIPs for additional public IPs at WAN to be used with 1:1 NAT. Please provide some more details about how your WAN looks like (multiple IPs, static, pppoe, dhcp, …) and what you want to achieve with your setup. A combination of portforward and advanced outbound with VIPs might make more sense depending what you want to do as this then even supports NAT reflection (if turned on).

            1 Reply Last reply Reply Quote 0
            • J
              joe4
              last edited by

              I am trying to

              run a web and email server on the DMZ.
              protect the LAN from inbound DMZ traffic.
              allow LAn to DMZ traffic.

              My WAN is static with about 15 addresses.

              I will try the VIP.

              You guys are a great help.
              Thanks.

              1 Reply Last reply Reply Quote 0
              • H
                hoba
                last edited by

                web and mail is only a bunch of single ports. I would use VIPs with portforwarding for port smtp, pop3, http (https, imap, …if neeeded) and advanced outbound NAT on top. Then enable nat reflection at system>advanced and your lan clients will even be able to access your webserver and mailserver by the public IP.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.