Routing to my LAB Network

[parky119]

Hi, new setup and im having issues with routing. I have a standard 192.168.0.0/24 network and also a 192.168.15.0/24 on the inside of my network.

I have static routes pointing to my lab on the pfsense firewall.

I can ping and access my lab from 1) my home network, 2) outside the firewall,

However, when im configuring esxi im having errors on ISCSI and errors on Datastore uploads.

In the firewall logs im seeing the traffic denied.

Why is the firewall denying traffic from LAN to LAN?
I have allowed the traffic, but it is still ignoring the rules and denying using the default rules on the LAN interface.

Any assistance appreciated.

[johnpoz]

Sounds like you have asymmetrical setup.

Whenever your going to have downstream router, you need to connect the routers with a transit network (network with no hosts).. Or your going to be asymmetrical in flow, and yeah any out of state traffic a firewall sees would be blocked..

Example drawing..

If your not going to use a transit, then you need to nat at your downstream router and use port forwarding on it to access stuff behind it. Or you need to use host routing on all devices that reside on the network between the upstream and downstream network (transit network)

[parky119]

JohnPoz, Thank you for your reply, my understanding of your post,

My router segregating traffic is currently configured as 192.168.1.253/24 on its LAN facing interface. The LAB facing interface is configured as 192.168.15.254/24.

The LAB Router has a Static route saying
0.0.0.0 0.0.0.0 192.168.1.254/24 (pfsense)

I should change the downstream router IP from 192.168.1.253/24 to (for example) 192.168.14.254/24 then change the pfsense static routes to
192.168.15.0/24 192.168.14.254

 

[johnpoz]

Yeah you should use a transit... But this should be a different L2 network.. Not just running different L3 on the same L2..

This is how it would be setup..

edit: btw, not seeing your drawing you posted?

[parky119]

Chrome fail! - Edge worked

[johnpoz]

Yeah that is not right.. Your 192.168.0/24 is your transit, and you have hosts on it.

BTW the way that looks your firewall there looks to be transparent.. But yeah that would be asymmetrical

[parky119]

Thanks again JohnPoz, I will try and redesign, either by moving my lab esxi inside the 192.168.0.0/24 network,

or by segregating both networks using l3, possibly add a router between the firewall and lab network.

[parky119]

Ok , i admit defeat, I tried to virtualise another instance of pfsense, then have one fw connecting to home and another connecting to the lab.

All the VLANs looked ok, but connectivity was intermittent from the vdsl router into either lab in even though static routes were specific.

As a temp measure ive moved my Lab ESXi into the 192.168.1.0/24 subnet.

Ive given up for now as wifey was complaing her works zoom kept dropping out!

Happy wifey happy lifey !!!

Thank you all for your help.

[johnpoz]

Why do you need a router in your esxi?

Your latest drawing doesn't make much sense to be honest. Now you just have 2 vlans off a router behind a double nat?

If you have both networks directly connected to the same router, there is no transit network.. Only when 2 routers are connected and you have a network on router A, and a different network on router B and you want them to talk to each other. Then the network that connects A and B together is a transit network - you do not put hosts on it..

The top of your drawing there makes no sense.. So you have 3 routers? You have a 0/29 and a 8/29 for why??