Simple DMZ setup with webserver

bluebird

Hi,

I just recently installed pfSense 2.0RC1 after having used ipCop for several years. I got everything working excepted the access to my web server in the DMZ (from internet).

WAN: dhcp
LAN: 192.1.1.0/24
DMZ: 192.1.2.0/24

Rules for DMZ:
Proto Source Port Destination Port Gateway Description
TCP DMZ net * 192.1.1.2 1433 * MS SQL
TCP * * LAN net * * Restrict to LAN

DMZ net * ! LAN net * * All but LAN

Rules for LAN:
Proto Source Port Destination Port Gateway Queue Schedule Description

RFC 1918 networks * * * * * Block private networks
Reserved/not assigned by IANA * * * * * * Block bogon networks
TCP * * 192.1.2.1 12500 * none NAT Web Server

Port forward:
If Proto Src. addr Src. ports Dest. addr Dest. ports NAT IP NAT Ports Description
WAN TCP * * DMZ net 12500 192.1.2.1 12500 Web Server

Is the configuration of the DMZ right? (can access internet, not LAN)
Why does the port forward generate a rule in the LAN?

Can some one have look an tell me what is wrong? I see the requests in the firewall log at port 12500, so they are not routed to 192.1.2.1:12500…

Thanks,
Daniel

illern

Hello Daniel!

This is how I should have done this setup.
First of all you should not use .0 in a computers IP adress.
Add 1 to all addresses so that the LAN and DMZ interfaces start with .1

I have done the rules below with your IP numbering from the previous post.

As I understand you have a MS SQL server on the LAN net that you want your Web server on the DMZ net to access.
Also you want to have full access to internet from DMZ net.
The DMZ net should not have access to LAN net.
LAN net have full access to DMZ and WAN net
And finally WAN net to DMZ net on tcp port 12500
This is at least how the setup below is supposed to work.

DMZ rules:
Type ID Proto Source Port Destination Port Gateway Queue Schedule Description
Allow TCP DMZ net * 192.1.1.2 1433 * none DMZ to LAN MS SQL
Allow * DMZ net * ! LAN net * * none DMZ to internet and block to LAN
Block * * * * * * none Block all

LAN rules
Type ID Proto Source Port Destination Port Gateway Queue Schedule Description
Allow * LAN Net * * * * none Default allow LAN to any rule

WAN rules
Type ID Proto Source Port Destination Port Gateway Queue Schedule Description
Allow TCP * * 192.1.2.1 12500 * none NAT WAN to DMZ webserver

NAT Port forward
If Proto Src. addr Src. ports Dest. addr Dest. ports NAT IP NAT Ports Description
WAN TCP * * WAN address 12500 192.1.2.1 12500 WAN to DMZ webserver

Also if you have Manual Outbound NAT rule generation you need to create a outbound nat rule for DMZ net like you have with LAN.

Hope this helps you on the way.

/illern.

bluebird

Thank you very much!

I see now better my error…