Firewall and routing for my LAN
-
@kramnoraa said in Firewall and routing for my LAN:
For the internet, yes, the route goes through the 5g network, but for the FTP there's no such route to go through the 5g network
And how can the machine differ this without a specific static route for the FTP?
If the the default route goes to the 5g, without specific routes, it will send traffic to all destinations outside of its own subnet to the default gateway, which is the 5g.How does the 5g go to the internet? Does it have a certain tunnel on its own or does it use 192.168.56.3 as upstream gateway?
-
@viragomann I've added static routes on both the user machine and the ftp machine to allow traffic between them based on their IP's, since the traffic gets sent to the 5g network by default, maybe i need to specify a route on the 5g machine itself to forward traffic to the ftp machine's IP ?
The 5g network when ran, creates a tunnel 'ogstun' that handles the traffic for the 5g network, from the open5gs docs, i've added this rule ' sudo iptables -t nat -A POSTROUTING -s 10.45.0.0/16 ! -o ogstun -j MASQUERADE ' when building the network for internet access i believe ( i might be wrong).
Would i add a rule somewhat like ' sudo iptables -t nat -A POSTROUTING -s 10.45.0.0/16 -d 192.168.56.121 -j ACCEPT ' to allow traffic from the user equipment, to the 5g network and then to the ftp server? instead of the user equipment's tunnel IP, 10.45.0.2 directly accessing the ftp server with the static route on the two machines
-
@kramnoraa said in Firewall and routing for my LAN:
I've added static routes on both the user machine and the ftp machine to allow traffic between them based on their IP's,
The static route on the user machine should be all you need.
since the traffic gets sent to the 5g network by default, maybe i need to specify a route on the 5g machine itself to forward traffic to the ftp machine's IP ?
We have to know, how the 5g goes out to get further. I requested this above.
Can you post its routing table, when the 5g network is running? -
Routing table for the machine thats running the 5g network ^
-
@viragomann
Routing table for user equipment machine ^ -
@kramnoraa said in Firewall and routing for my LAN:
Routing table for the machine thats running the 5g network ^
Why is the default gateway 192.168.1.1? You didn't mention this subnet till now.
Shouldn't it rather be 192.168.56.3?Also I don't get, why the user machine has a route for the FTP bound to uesimtun, since it should have an IP in the LAN on enp0s3.
-
@viragomann I want the communication for the ftp from user machine to go via the uesimtun0 which has an IP of 10.45.0.3, this would mean that the connection is going through the 5g network and not directly from the user machine to the ftp machine (its using the generated tunnel). Thats why im routing all traffic from the user to ftp machine with the rule 'sudo add ip route 192.168.56.121 dev uesimtun0' on the user machine and 'sudo ip route add 10.45.0.3 dev enp0s8' on the ftp machine, only with these static routes on the machines, i can access the ftp from the user machine, and its using the 10.45.0.3 IP rather than its host only 192.168.56.115 IP to communicate with it, confirmed with a tcpdump
-
@kramnoraa said in Firewall and routing for my LAN:
I want the communication for the ftp from user machine to go via the uesimtun0 which has an IP of 10.45.0.3, this would mean that the connection is going through the 5g network and not directly from the user machine to the ftp machine (its using the generated tunnel).
Okay, if this is what you want, you will not get rid of the static routes, as long as you don't logically separate the FTP from use machine and put it into another network segment.
The static route on the FTP is needed as well then to avoid asymmetric routing.
-
@viragomann Alright, initially my plan was to get rid of the static routes that i created on each machine except the 5g machine for security simulation purposes, and let pfsense handle all the routing. Maybe this isn't possible, although it should be i assume?
Regardless, im not able to control the traffic on the firewall (i want to allow/block ftp access from user machine) even with these static routes on each machine. I am only able to monitor the connections in the packet captures, but no access control
Any recommendations on how I can do this ?
-
@kramnoraa said in Firewall and routing for my LAN:
@viragomann Alright, initially my plan was to get rid of the static routes that i created on each machine except the 5g machine for security simulation purposes, and let pfsense handle all the routing. Maybe this isn't possible, although it should be i assume?
As I implied above, just put the FTP into another network segment. It's a virtual machine and a virtual network, so this wouldn't be a big deal.
-
@viragomann Thank you for your prompt replies.
Okay i see, sorry i'm just a bit confused as to why putting the FTP into another network segment other than the .56.0/24 subnet would change things, bit lost as to how this would help me have access control using pfsense
right now the user machine is using 10.45.0.3 and 192.168.56.115
the ftp is on 192.168.56.121so if i move the ftp to 192.168.57.121, how would this change let me have control over the traffic flow ?
-
@kramnoraa said in Firewall and routing for my LAN:
Okay i see, sorry i'm just a bit confused as to why putting the FTP into another network segment other than the .56.0/24 subnet would change things, bit lost as to how this would help me have access control using pfsense
This doesn't help to control the access, but to get rid of static routes.
If the traffic passes pfSense anyhow, but not tunneled, you should be able to monitor and control it.
However, the pfSense IP in the tunnel subnet might be pretty useless for this, as mentioned above already.Since you don't clarify, how the 5g work, I can only make assumptions on this.
I guess, that the 5g uses 192.168.56.3 as default gateway and do masquerading on upstream traffic. All already mentioned.
This would mean, that when you access the FTP from the user machine (with routes), pfSense is seeing FTP access from the 5g with the source IP 192.168.56.116.
Don't you see this traffic? -
Hmm, this is a confusing thread!
Unclear exactly what you're trying to do here.
Whatever it is I'd be amazed if you're not hitting some asymmetric routing issues. I agree it would be much beter to have the FTP server in a different subnet so you can correct route to it and filter traffic.
-
@stephenw10 said in Firewall and routing for my LAN:
Hmm, this is a confusing thread!
Yes, I guess, this is since no one here knows, what the 5g stuff really does.
And the TO sadly does enlighten us. -
@stephenw10 @viragomann Understood, will try that now!
What im trying to do is:
I am trying to simulate a 5g network with a user equipment connecting into the network and the user equipment using the ftp server as a service through the 5g network.
The 5g network VM has an IP of 192.168.56.116/24, when the network is ran it creates a tunnel 'ogstun' that has an IP of 10.45.0.1/16. VBOX adapters (Bridged adapter and host only).
The user equipment machine has an IP of 192.168.56.115, when the user equipment is built, it creates a tunnel 'uesimtun0' that has an IP of 10.45.0.2/32. VBOX adapters (host only)
The ftp machine has an IP of 192.168.56.121/24 . VBOX adapters (host only)
The pfSense machine has the IP 192.168.56.3/24 for its LAN interfaceI created two interfaces on pfsense web gui, LAN (192.168.56.3/24) and LAN2 (10.45.0.3/16). The firewall rules i added on LAN: any protocol, source (LAN net), destination (LAN1 net).
The rules i added on LAN2:- any protocol, source (LAN1 net), destination (LAN net) and also another rule
- any protocol, source (LAN net), destination (LAN1 net)
With these rules and the ip routes configured on the individual machines, i am able to monitor all the necessary connections but unable to control traffic which is what I want.
The 5g tunnel ogstun is responsible for handling all traffic flow in and out of the network, the uesimtun0 tunnel is responsible for handling all user equipment traffic flow. When i connect to the ftp server using the uesimtun0 on the user machine and do a tcpdump on the 5g machine for the ogstun interface, the traffic is being flown correctly, so i'm thinking the traffic is going to the 5g network and then to the ftp machine
I am trying to demonstrate a bit of added security in this local 5g network which is why i wanted to use a firewall in the first place, so that i am able to monitor all traffic flow and consequently filter traffic. Sorry for confusing you guys! as i am even more confused myself :D
-
@kramnoraa From a quick glance at your drawing, yeah I would be with @stephenw10 this screams asymmetrical to me.. So that device you have listed with 10.45.0.2/32 is multihomed - that is a asymmetrical waiting to happen for sure.
Why exactly do you have interfaces in a bridge in pfsense? And they are using 2 different L3 networks?
-
@kramnoraa said in Firewall and routing for my LAN:
The 5g network VM has an IP of 192.168.56.116/24, when the network is ran it creates a tunnel 'ogstun' that has an IP of 10.45.0.1/16. VBOX adapters (Bridged adapter and host only).
The user equipment machine has an IP of 192.168.56.115, when the user equipment is built, it creates a tunnel 'uesimtun0' that has an IP of 10.45.0.2/32. VBOX adapters (host only)
I created two interfaces on pfsense web gui, LAN (192.168.56.3/24) and LAN2 (10.45.0.3/16).This part is not clear to me. I appealed above already.
How should pfSense get a leg into the tunnel between the 5g and the user equipment, even it has an IP?When i connect to the ftp server using the uesimtun0 on the user machine and do a tcpdump on the 5g machine for the ogstun interface, the traffic is being flown correctly, so i'm thinking the traffic is going to the 5g network and then to the ftp machine
What do you see on on the enp0s3 adapter with the IP 192.168.56.3 in this case?
I expect, that the traffic to the FTP goes out there. But it goes directly to the FTP, since it's within the same network segment.Multiple times mentioned: Put the FTP server into another network segment, then you will be able to control access to it.
If the 5g machine masquerades the traffic with 192.168.56.3 the routing should work though. -
How is the pfSense LAN2 interface connected to the '5G tunnel' subnet? It seems like that would only exist for devices with tunnel adapters.
Is this all inside Virtual Box?
But, yes, you are starting from a position of having the client device, the 5G VM and the FTP server all inside the same subnet. So you are having to force the traffic flow to make it go via the tunnel subnet.
If you had separate subnets with pfSense routing between them this would be much easier. -
I'm guessing that the idea with the "tunnel" IP's (10.145.0.1, .2) is to simulate a mobile network? So the UE will need to have the 5G RAN Simulator as it's gateway and pretty much "forget about" the 192. network that the VM was running on.
And I'm thinking that the RAN SIM needs to have pfsense as it's default gateway (for example on 192.168.1.1). And the FTP server on a different network segment so that the requests that come in from the UE on the simulated network, are ROUTED to the 192.168.56.0 network where the FTP is located.
This means that the FTP server is on a different network segment than the SIM VM's. Then you can set up a rule in pfsense that allows or blocks access to the FTP server from the 5G SIM.
-
@Gblenn @stephenw10 @johnpoz @viragomann @SteveITS
I have changed up the network architecture a bit to hopefully make it a bit easier.
I am using internal network as my adapters on virtual box for all machines.My 5G vm still has the same address - 10.45.0.1/16
I have one user equipment machine the virtual interface 'uesimtun0' - IP 10.45.0.2/32
I have another user equipment running on the ftp machine, so that it also has the virtual 'uesimtun0' interface - IP 10.45.0.3/32
Pfsense virtual machine has the IP 192.168.56.1Communication flow
user 1 (uesimtun0) > (ogstun) 5g network (ogstun) > (uesimtun0) user equipment 2 and then ftp accessI have the gateway defined in pfsense webgui as 192.168.56.1
Problem:
When i ping any from one user to another user address, the traffic is being sent correctly through the virtual tunnels mentioned above, this is confirmed with a tcpdump on the 5g machines virtual interface, ogstun. When i ping the pfsense IP from a user machine using the virtual tunnel and do a tcpdump on the 5g networks virtual interface, i only see ICMP requests and no replies, but when i do a tcpdump on the enp0s8 adapter, there are requests and replies.How can i forward the traffic correctly so that it reaches the virtual tunnel rather than the virtual box adapter? or if the issue is not that, what is going wrong ?
When i ping either the user machines or access the ftp server from the pfsense shell itself, the traffic is being routed properly, confirmed with a tcpdump on the 5g network virtual interface
