Routing in RFC1918 wan range

[hawker]

Hello

I use Pfsense box (1.2.2 release) to connect multiple private site. Each distant site use RFC1918 IP address network.
My LAN network respect RFC1918 also.

I use router1 IP address as gateway on pfsense box and i define a static route for site2.
I disable Block private networks and Block bogon network on each network interface.

My LAN server can contact all host (SITE1 and SITE2)
ALL host on site1 (172.17.0.0/16) can connect to Lan server (172.16.0.0/16)
But Site2 have some touble….

In fact, when i sniff traffic on PFsense WAN interface, i see the traffic come in and answers come out.
The answer traffic works like if it doesnt use static route.

I make different test:

• If i change the WAN ip address on PFsense box for router2 IP address, the problem is the same with SITE1 (so bad idea)
• If i define site2 IP route on router1 it work for site2 (in fact my only solution but not possible)
• If i disable firewall option in PFsense it's work (ok but i need firewall)

Pfsense react like if for RFC1819 answers traffic on WAN interface it doesnt use static route.

I rapidely check with a old version of pfsense ( before 1.0)  and it seen to works fine!

Bug ?? or any idea ?

Thanks

Regards

Jerome

router1
SITE1 (172.17.0.0/16) <----O----           
                                              |                  ---------
                                              |----WAN ---|Pf sense |---- LAN -----------(172.16.0.0/0)
                                              |                  ---------                |
SITE2 (172.18.0.0/16) <----O----                                              ---
                                  router2                                                [  ] Lan Server
                                                                                            –-

[dotdash]

What is your WAN wan addressing scheme? One way to do this is to use a separate shared subnet for the WANs:
              router1          r1wan=10.20.30.2
SITE1 (172.17.0.0/16) <–--O----            10.20.30.1
                                              |                  ---------
                                              |----WAN ---|Pf sense |---- LAN -----------(172.16.0.0/0)
                                              |                  ---------                |
SITE2 (172.18.0.0/16) <----O----                                              ---
                                  router2 r2wan=10.20.30.3                            [  ] Lan Server

Then your static routes route the remote lan via the site's wan ip.

[hawker]

Yes i use the same ip address  like in your scheme
in your sample i use 10.20.30.2 as gateway and i define 10.20.30.3 for join 172.18.0.0/16

I think it's not a routing problem cause if i disable firewall it's work fine.

[dotdash]

What are your outbound NAT settings? I'd think in your case, you would use AON and delete the default rule.

[hawker]

I dont use NAT. Only routing
my wan network is a private network

[dotdash]

That's what I meant. Just wanted to make sure you had deleted the default rule, as pfsense by default NATs the LAN range over the WAN.

[hawker]

Yes the default NAT was delete

perhaps i need to post in firewalling section ?

[hawker]

No idea ?

[dotdash]

That's all I got. It's not a configuration I have deployed. You could try checking the box 'bypass firewall rules for traffic on the same interface' under advanced.

[hawker]

this option was already enabled

If i check Disable all packet filtering option routing is ok