Need help on adding a firewall to the network
-
I need to add a firewall between the MPLS and our network,
the problem is that I cannot change the MPLS IP without calling our ISP. also I may need to go back. Lan and Wan would have the same subnet
can the problem be solved without changing the MPLS ip? -
@kiokoman So the firewall in your drawing is pfsense? And you host route on all these devices in the 192.168.8 network to talk to 8.1 (mpls router) vs pfsense at 8.7 to get to the internet? Or other local networks.
You could always add a transparent firewall on this 8 network.. But better solution would be to get mpls network changed to something you just use for a transit network to pfsense.
Maybe say 172.16.8.0/29 or even /30 would work..
Now you wouldn't need any host routes on these devices pointing to 8.1 for these 192.168.1xx networks. And you could still leave 192.168.8/24 on all your devices.
-
@johnpoz
yes, there are 2 pfsense firewall (HA), the static routes are configured inside pfsense, that route leads to another DC of a customer (we go to the internet via 8.7 (Carp), we go to another local network via 8.1). we need to access them but they should not access our network so we need to put another pfsense firewall between the MPLS and our network. we need to call the ISP to change that IP so i was thinking what could be done. my first assignment in the new job was to configure HA and openvpn with 2FA
-
@kiokoman said in Need help on adding a firewall to the network:
the static routes are configured inside pfsense
Well that screams asymmetrical to me... If your clients are talking to pfsense on 8.7, and it sends traffic to 8.1 to get to one of those 100 networks.. The return traffic wouldn't go back to pfsense it would just go back to whatever 8.x IP..
That is bad..
-
@johnpoz
indeed it is.
I'm here to fix this
my intention is to change ip to that mpls and move it to the pfsense wan and remove that static routes -
Well you could move the mpls connection to a wan on pfsense sure, but that would still need routing.. You could do something dynamic vs static.. But that can add complexity, so unless your using it for monitoring of path to change routing, or networks come and go all the time.. A hand full of static routes is easier solution.
