Gateway offline
-
I have two pfSense, one in front of the other.
The first (FW1) has the WAN port in DHCP and the LAN port 192.168.1.1/29 with a DHCP Server.
At the moment on the LAN there is the default rule that allows navigation and in fact if I connect a PC in this IP range I can navigate without problems.The second (FW2) has the WAN port in DHCP and the LAN port already configured with various rules.
If I connect the WAN FW2 to the router, so bypassing FW1, I can surf without problems.
If, on the other hand, I connect the WAN of FW2 to the LAN of FW1, the gateway of FW2 goes offline.
Even setting static IPs does not work. -
@whitetiger-it
I presume you do NAT on both firewalls.
If so, ensure that the LAN networks are not overlapping.Also ensure that the outbound NAT is in automatic mode on both or check the rules.
-
@viragomann said in Gateway offline:
@whitetiger-it
I presume you do NAT on both firewalls.
If so, ensure that the LAN networks are not overlapping.Also ensure that the outbound NAT is in automatic mode on both or check the rules.
There is no NAT on FW1.
On FW2 there is, but it is towards the DMZ. -
@whitetiger-it said in Gateway offline:
There is no NAT on FW1.
So you have to route the traffic through FW1 and your router has to be aware of the network behind FW2, i.e. you need a route on it. (?)
-
@viragomann
The way I see things, there shouldn't be a NAT.
FW1 should see FW2 just like any other PC browsing the Internet from its LAN.
Once on FW1 there are rules for HTTP, HTTPS, FTP, etc.
traffic should already be routed correctly on FW2 if it is required by this.
Then, in FW2 there should be other rules to route traffic to those who have requested it.NAT should be there to route traffic over the DMZ.
However, my problem should be related to something else.
I will try to put the LAN-FW1 and WAN-FS2 cables on a dedicated switch, rather than on the switch itself. -
@viragomann
I moved the cables of LAN NIC FW1 and of WAN NIC FW2 to a dedicated switch.
I then cleaned up the various rules of both firewalls because evidently by doing continually test then some rules overlapped each other.
Now the gateway goes and from the LAN of FW2 I can navigate passing through FW2 and FW1.
Thanks for your help.