Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Proxmox + PFSense conection port forward

    Scheduled Pinned Locked Moved NAT
    21 Posts 3 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      Lixaotec
      last edited by

      Dear folks,

      Can anyone help me with my PFSense config?

      Dear folks,

      I have a Proxmox with a PFSense VM and Im trying to reach PFSense through Proxmox shell.

      The network is setup as follows:

      ISP modem (with dhcp 192.168.100.1)

      Proxmox connected to isp modem, static 192.168.100.10 (vmbr0)

      PFsense a vm inside Proxmox, also gets an ip from isp modem (192.168.100.6) vmbr0

      inside PFSense I created a NAT Port Forwarind to a linux VM, also inside proxmox (192.168.1.100) another iface, vmbr1 , and listen with netcat to test

      When I use another machine that also connected to isp modem (192.168.100.12) I can do a netcat sucessfully.

      However when I try from inside of proxmox shell to netcat that port, it does not works. Even traceroute does not works to PFSense ip. However it works if I tracerout to the outside machine.

      ip route
      default via 192.168.100.1 dev vmbr0 proto kernel onlink
      192.168.100.0/24 dev vmbr0 proto kernel scope link src 192.168.100.10

      In fact its something on PFSense, i did a shell at PFSense and started a nc listening at some port, and frmo proxmox i could connect to it sucefully simply by using its isp router ip 192.168.100.6

      So i guess its something inside PFSense.

      The bad news for me is that I have tried everything I know, and a bunch of tips from internet, like nat reflection, assymetric nat.. none has solved it.

      the pfsense is brand new installation, so no rules that could affect it.

      i dont know much about routing, however I can see that connection is reaching pfsense now and it becomes SYS_SENT / CLOSED

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @Lixaotec
        last edited by

        @Lixaotec said in Proxmox + PFSense conection port forward:

        Proxmox connected to isp modem, static 192.168.100.10 (vmbr0)
        PFsense a vm inside Proxmox, also gets an ip from isp modem (192.168.100.6) vmbr0
        inside PFSense I created a NAT Port Forwarind to a linux VM, also inside proxmox (192.168.1.100) another iface, vmbr1 , and listen with netcat to test
        When I use another machine that also connected to isp modem (192.168.100.12) I can do a netcat sucessfully.
        However when I try from inside of proxmox shell to netcat that port, it does not works.

        Proxmox has no correct route to the machine behind pfSense. It will send its packets to the ISP router which is the default gateway.

        If you really want to access this VM from Proxmox over vmbr0 and pfSense, you have to add a static route to Proxmox for the vmbr1 network pointing to 192.168.100.6.

        1 Reply Last reply Reply Quote 1
        • L
          Lixaotec
          last edited by

          Dear @viragomann

          Thanks for replying.

          Shouldnt be PFSense responsability to route from inside to vmbr1?

          vmbr1 is dhcp server inside proxmox, i thought it would never be accessible diretly from proxmox either, thats why I am trying nat port fowrd

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @Lixaotec
            last edited by

            @Lixaotec said in Proxmox + PFSense conection port forward:

            Shouldnt be PFSense responsability to route from inside to vmbr1?

            Yes, but pfSense isn't involved as long Proxmox sends its packets to the wrong device.

            So just fire up a traceroute to 192.168.1.100 on proxmox and look, where the packets go to be sure.

            1 Reply Last reply Reply Quote 0
            • L
              Lixaotec
              last edited by

              Sorry I told wrong stuff.

              vmbr1 is a dhcp Inside PFSense, not proxmox.

              1 Reply Last reply Reply Quote 0
              • L
                Lixaotec
                last edited by

                traceroute to 192.168.1.100 (192.168.1.100), 30 hops max, 60 byte packets
                1 * 192.168.100.1 (192.168.100.1) 0.485 ms 0.656 ms
                2 100.127.255.6 (100.127.255.6) 5.480 ms 5.542 ms 5.602 ms
                3 * * *
                4 * * *
                5 * * *
                6 * * *
                7 * * *
                8 * * *
                9 * * *
                10 * * *
                11 * * *
                12 * * *
                13 * * *
                14 * * *
                15 * * *
                16 * * *
                17 * * *
                18 * * *
                19 * * *
                20 * * *
                21 * * *
                22 * * *
                23 * * *
                24 * * *
                25 * * *
                26 * * *
                27 * * *
                28 * * *
                29 * * *
                30 * * *

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  If your on the wan network of pfsense.. BTW 192.168.100 is horrible choice for a network - this is the default for cable modems when they don't have access. And you can access their status page on 192.168.100.1.. So I assume you don't actually have a "modem" but some gateway device... What is the make and model number of this "modem"?

                  Anyhoo - if your wan network is 192.168.100/24 and you want to get to something behind pfsense 192.168.1.X then out of the box pfsense is natting to 192.168.100.6 for any devices behind it on this 192.168.1 network

                  So setup a port forward, and access 192.168.100.6 on port X and pfsense will send you to that IP and port you setup.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann
                    last edited by

                    So the next hop is 192.168.100.1, your ISP modem. 100.127.255.6 may be your internet upstream gateway.

                    So as I mentioned above, Proxmox send its packets to the IPS moedem, since it as no route to 192.168.1.100. So add a route to Proxmox and it should work.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      How is going to work when pfsense nats out of the box. Did he turn off natting?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • V
                        viragomann
                        last edited by

                        As I understood his first post, he only want to access the machines behind pfSense from Proxmox, but not the other way round.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Huh?? If proxmox had an IP in this 192.168.1 network - he would have no need of creating any routes in the first place. when talking to 192.168.1.x it would use its IP in that interface.

                          If the HOST does not have an ip in this network, then he would need to route yes. But since pfsense is the router to get to 192.168.1 - and it nats this network out of the box.. He would have to setup port forwarding, and hit the IP of pfsense wan - so again no routing is involved.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          V 1 Reply Last reply Reply Quote 0
                          • L
                            Lixaotec
                            last edited by Lixaotec

                            its an optical cable modem. Huawei. Configs are default from isp (they burnt a customized firmware, that wont work with any other changes, really a s**t)

                            However, I did the nat, and it works when coming from other device on that modem.

                            192.168.100.1 - Isp modem DHCP
                            192.168.100.10 - Proxmox (vmbr0)
                            192.168.100.6 - PfSense (inside Proxmox - vmbr0) WAN
                            192.168.100.12 - external device

                            vmbr1 - inside PFSense LAN
                            192.168.1.1 - PFsense dhcp
                            192.168.1.100 - my vm with 4444 port open

                            from .12 i manage to connect to the nat port forward at PFSense, lets say 192.168.100.6:4444

                            from .10 i cant connect to 192.168.100.6:4444 (i can see packages arriving in PFSense with CLOSED:SYN_SENT)

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Well if devices on your network behind pfsense have firewall.. Pfsense can send the traffic to this IP all day long - doesn't mean that box will answer..

                              Here is the thing - sniff on pfsense lan interface in pfsense. Do you see it send the traffic on that you port forward? If so then pfsense did what its suppose to do.. If you get not answer that is nothing pfsense can do about that.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • L
                                Lixaotec
                                last edited by

                                PFSense is a brand new installation , clean of rules, only the nat rule for that port is configured

                                Why it accpets from one device, and not from another (proxmox)?

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  You could have an issue in promox where your using the same interface to try and talk to itself just with another IP..

                                  Sniff on pfsense - does it see the traffic to its wan IP, does it port forward it?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    Lixaotec
                                    last edited by

                                    06b38055-11e2-4ba8-ae48-0161871f4410-image.png

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann @johnpoz
                                      last edited by

                                      @johnpoz said in Proxmox + PFSense conection port forward:

                                      If proxmox had an IP in this 192.168.1 network

                                      No, it hasn't as I understood. It has only an IP in 192.168.100.x

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        So pfsense sent the SYN to you dest box - if it doesn't answer what is pfsense suppose to do? Does that dest VM have pfsense as its gateway? Does it have a firewall? Is it even listening on that port? Did it even see the traffic pfsense sent it?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        L 1 Reply Last reply Reply Quote 0
                                        • L
                                          Lixaotec @johnpoz
                                          last edited by

                                          Dear @johnpoz

                                          When Promox communicate with 192.168.100.6 (pfsense) the packages seems to be arriving at PFSense, verified by states print above.

                                          The dest VM 192.168.1.100 have pfsense as its gateway 192.168.1.1, and it is listening, I also confirm that because I can reach it from 192.168.100.12

                                          vm dest does not have firewall enable, its a raw ubuntu server

                                          1 Reply Last reply Reply Quote 0
                                          • L
                                            Lixaotec
                                            last edited by

                                            I reach it from the same nat rule .. it works from 192.168.100.12, but not from 192.168.100.10 (proxmox).

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.