Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Physical host unable to ping virtual host through virtual pfSense firewall

    Virtualization
    support proxmox
    3
    11
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dingodoggo69
      last edited by

      Hey guys,

      I'm fairly new to virtualization and have begun the process of virtualizing a firewall using dedicated hardware in Proxmox. I've got everything up and running but I'm having some issues. Currently I have a WAN interface, a physical LAN interface and a virtual OPT1 interface for my virtual servers. I have allow any rules on the LAN and OPT1 interface for testing. LAN is a 10.10.10.1/24 interface and OPT1 is a 10.10.20.1/24 interface. I have a virtual server 2022 sitting at 10.10.20.5 and a physical laptop at 10.10.10.10. From both devices I have outbound Internet connectivity as expected. Both are unable to ping one another. Checking firewall logs I can see the traffic being allowed but traceroutes show it not going pass the firewalls interface. Pinging from the firewall to either of these addresses results in 100% transmission lost. Routes are shown for each network. From each device I can ping the gateway of each interface. I created another virtual interface on the LAN subnet on a separate VM and can ping from the OPT1 2022 VM to the LAN VM.

      Not sure what's causing the issue but I suspect it's likely something to do with the virtualization of the physical hardware. Any assistance would be hugely beneficial.

      NollipfSenseN S 2 Replies Last reply Reply Quote 0
      • NollipfSenseN
        NollipfSense @dingodoggo69
        last edited by

        @dingodoggo69 You need to show us your firewall rules.

        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

        D 1 Reply Last reply Reply Quote 0
        • D
          dingodoggo69 @NollipfSense
          last edited by

          @nollipfsense sorry, I should've said I just have any any rules on all interfaces but the WAN.

          1 Reply Last reply Reply Quote 0
          • S
            SteveITS Galactic Empire @dingodoggo69
            last edited by

            @dingodoggo69 “any” rules allow ICMP not just TCP? Is the firewall on the target set to allow ICMP from outside its subnet?

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote 👍 helpful posts!

            D 1 Reply Last reply Reply Quote 0
            • D
              dingodoggo69 @SteveITS
              last edited by

              @steveits given its set set to pass any traffic on both interfaces I would think any protocol would be accepted between subnets, unless I'm mistaken?

              S 1 Reply Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @dingodoggo69
                last edited by

                @dingodoggo69 The rule needs to say protocol “IPv4 *” not the default TCP. It happens a decent amount here on the forums and I’ve done it myself, so just asking.

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote 👍 helpful posts!

                D 1 Reply Last reply Reply Quote 0
                • D
                  dingodoggo69 @SteveITS
                  last edited by

                  @steveits yep I see what you mean, set to IPv4 and any protocol so shouldn't be that.

                  1 Reply Last reply Reply Quote 0
                  • NollipfSenseN
                    NollipfSense
                    last edited by NollipfSense

                    I am now facing this issue but the other way around...I can ping pfSense LAN from a Mac Pro connected Proxmox management port but cannot ping the physical host from pfSense LAN...keep getting host is down. I would like to get pfSense dashboard on the tab next to the tab with Proxmox management.

                    Screenshot 2023-05-04 at 1.13.28 AM.png

                    pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                    pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      dingodoggo69 @NollipfSense
                      last edited by

                      @nollipfsense have you checked host firewall settings? I fixed this by disabling the firewall on the host, ensuring NAT was setup for the LANs and setting a gateway within the DHCP servers.

                      NollipfSenseN 1 Reply Last reply Reply Quote 0
                      • NollipfSenseN
                        NollipfSense @dingodoggo69
                        last edited by NollipfSense

                        @dingodoggo69 I had not configured firewall on Proxmox and is using whatever is set by default. I did setup firewall rule on pfSense to allow connections to and from Proxmox management port. Can I see your configuration?

                        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                        1 Reply Last reply Reply Quote 0
                        • NollipfSenseN
                          NollipfSense
                          last edited by NollipfSense

                          Now, I got it right without the need to disable any firewall...my mistake was to move default gateway to pfSense. The default gateway is just for Proxmox management port to update itself and need to remain on the port originally assigned. Then, I made pfSense LAN that IP. Both accessible by my Mac Pro on the same browser tabs next to each other.

                          Screenshot 2023-05-06 at 3.14.07 PM.png

                          pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                          pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.