Proxmox + PFSense conection port forward
-
Dear folks,
Can anyone help me with my PFSense config?
Dear folks,
I have a Proxmox with a PFSense VM and Im trying to reach PFSense through Proxmox shell.
The network is setup as follows:
ISP modem (with dhcp 192.168.100.1)
Proxmox connected to isp modem, static 192.168.100.10 (vmbr0)
PFsense a vm inside Proxmox, also gets an ip from isp modem (192.168.100.6) vmbr0
inside PFSense I created a NAT Port Forwarind to a linux VM, also inside proxmox (192.168.1.100) another iface, vmbr1 , and listen with netcat to test
When I use another machine that also connected to isp modem (192.168.100.12) I can do a netcat sucessfully.
However when I try from inside of proxmox shell to netcat that port, it does not works. Even traceroute does not works to PFSense ip. However it works if I tracerout to the outside machine.
ip route
default via 192.168.100.1 dev vmbr0 proto kernel onlink
192.168.100.0/24 dev vmbr0 proto kernel scope link src 192.168.100.10In fact its something on PFSense, i did a shell at PFSense and started a nc listening at some port, and frmo proxmox i could connect to it sucefully simply by using its isp router ip 192.168.100.6
So i guess its something inside PFSense.
The bad news for me is that I have tried everything I know, and a bunch of tips from internet, like nat reflection, assymetric nat.. none has solved it.
the pfsense is brand new installation, so no rules that could affect it.
i dont know much about routing, however I can see that connection is reaching pfsense now and it becomes SYS_SENT / CLOSED
-
@Lixaotec said in Proxmox + PFSense conection port forward:
Proxmox connected to isp modem, static 192.168.100.10 (vmbr0)
PFsense a vm inside Proxmox, also gets an ip from isp modem (192.168.100.6) vmbr0
inside PFSense I created a NAT Port Forwarind to a linux VM, also inside proxmox (192.168.1.100) another iface, vmbr1 , and listen with netcat to test
When I use another machine that also connected to isp modem (192.168.100.12) I can do a netcat sucessfully.
However when I try from inside of proxmox shell to netcat that port, it does not works.Proxmox has no correct route to the machine behind pfSense. It will send its packets to the ISP router which is the default gateway.
If you really want to access this VM from Proxmox over vmbr0 and pfSense, you have to add a static route to Proxmox for the vmbr1 network pointing to 192.168.100.6.
-
Dear @viragomann
Thanks for replying.
Shouldnt be PFSense responsability to route from inside to vmbr1?
vmbr1 is dhcp server inside proxmox, i thought it would never be accessible diretly from proxmox either, thats why I am trying nat port fowrd
-
@Lixaotec said in Proxmox + PFSense conection port forward:
Shouldnt be PFSense responsability to route from inside to vmbr1?
Yes, but pfSense isn't involved as long Proxmox sends its packets to the wrong device.
So just fire up a traceroute to 192.168.1.100 on proxmox and look, where the packets go to be sure.
-
Sorry I told wrong stuff.
vmbr1 is a dhcp Inside PFSense, not proxmox.
-
traceroute to 192.168.1.100 (192.168.1.100), 30 hops max, 60 byte packets
1 * 192.168.100.1 (192.168.100.1) 0.485 ms 0.656 ms
2 100.127.255.6 (100.127.255.6) 5.480 ms 5.542 ms 5.602 ms
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * * -
If your on the wan network of pfsense.. BTW 192.168.100 is horrible choice for a network - this is the default for cable modems when they don't have access. And you can access their status page on 192.168.100.1.. So I assume you don't actually have a "modem" but some gateway device... What is the make and model number of this "modem"?
Anyhoo - if your wan network is 192.168.100/24 and you want to get to something behind pfsense 192.168.1.X then out of the box pfsense is natting to 192.168.100.6 for any devices behind it on this 192.168.1 network
So setup a port forward, and access 192.168.100.6 on port X and pfsense will send you to that IP and port you setup.
-
So the next hop is 192.168.100.1, your ISP modem. 100.127.255.6 may be your internet upstream gateway.
So as I mentioned above, Proxmox send its packets to the IPS moedem, since it as no route to 192.168.1.100. So add a route to Proxmox and it should work.
-
How is going to work when pfsense nats out of the box. Did he turn off natting?
-
As I understood his first post, he only want to access the machines behind pfSense from Proxmox, but not the other way round.
-
Huh?? If proxmox had an IP in this 192.168.1 network - he would have no need of creating any routes in the first place. when talking to 192.168.1.x it would use its IP in that interface.
If the HOST does not have an ip in this network, then he would need to route yes. But since pfsense is the router to get to 192.168.1 - and it nats this network out of the box.. He would have to setup port forwarding, and hit the IP of pfsense wan - so again no routing is involved.
-
its an optical cable modem. Huawei. Configs are default from isp (they burnt a customized firmware, that wont work with any other changes, really a s**t)
However, I did the nat, and it works when coming from other device on that modem.
192.168.100.1 - Isp modem DHCP
192.168.100.10 - Proxmox (vmbr0)
192.168.100.6 - PfSense (inside Proxmox - vmbr0) WAN
192.168.100.12 - external devicevmbr1 - inside PFSense LAN
192.168.1.1 - PFsense dhcp
192.168.1.100 - my vm with 4444 port openfrom .12 i manage to connect to the nat port forward at PFSense, lets say 192.168.100.6:4444
from .10 i cant connect to 192.168.100.6:4444 (i can see packages arriving in PFSense with CLOSED:SYN_SENT)
-
Well if devices on your network behind pfsense have firewall.. Pfsense can send the traffic to this IP all day long - doesn't mean that box will answer..
Here is the thing - sniff on pfsense lan interface in pfsense. Do you see it send the traffic on that you port forward? If so then pfsense did what its suppose to do.. If you get not answer that is nothing pfsense can do about that.
-
PFSense is a brand new installation , clean of rules, only the nat rule for that port is configured
Why it accpets from one device, and not from another (proxmox)?
-
You could have an issue in promox where your using the same interface to try and talk to itself just with another IP..
Sniff on pfsense - does it see the traffic to its wan IP, does it port forward it?
-
-
@johnpoz said in Proxmox + PFSense conection port forward:
If proxmox had an IP in this 192.168.1 network
No, it hasn't as I understood. It has only an IP in 192.168.100.x
-
So pfsense sent the SYN to you dest box - if it doesn't answer what is pfsense suppose to do? Does that dest VM have pfsense as its gateway? Does it have a firewall? Is it even listening on that port? Did it even see the traffic pfsense sent it?
-
Dear @johnpoz
When Promox communicate with 192.168.100.6 (pfsense) the packages seems to be arriving at PFSense, verified by states print above.
The dest VM 192.168.1.100 have pfsense as its gateway 192.168.1.1, and it is listening, I also confirm that because I can reach it from 192.168.100.12
vm dest does not have firewall enable, its a raw ubuntu server
-
I reach it from the same nat rule .. it works from 192.168.100.12, but not from 192.168.100.10 (proxmox).
