Pfsense + vmware



  • I have this network structure

    modem <–----> router <----> switch <-----> servers / computers

    I have a machine with win7, and running vmware with 1 network card.

    in vmware, I have windows 2008 and another vm with pfsense doing firewall / proxy.

    how do I pass by every network pfsense when accessing the internet?

    I'll have to configure the switch? need to have 2 virtual interfaces in pfsense?

    this is feasible network structure?



  • @dgiorgio:

    how do I pass by every network pfsense when accessing the internet?

    The question is hard to understand. Please rephrase your question.



  • I have a physical machine with windows 7 and connected to the switch.

    this machine is installed vmware.

    in vmware, I have windows 2008 and pfsense
    windows 2008 is running AD and DNS.
    pfsense is running firewall and proxy.

    all other machines are connected to the switch.

    these machines do login with AD in windows 2008.

    how do I get all the machines pass through pfsense "firewall / proxy"?


  • Netgate Administrator

    You will need some sort of vlan setup in order to protect the external machines. pfSense requires 2 interfaces, virtual or otherwise,  to function as a firewall.

    Steve



  • I have two virtual interfaces, nat and bridge.

    em0 - WAN - interface NAT
    em1 - LAN - interface bridge

    how to share internet from wan to lan?



  • I will put my network structure in more detail.

    2x modem <–----> router(sonicwall) <----> switch <-----> servers/computers
    All machines are connected to the switch.

    I have a machine with VMware. In VMware I have Windows 2008r2 and pfSense. The pfSense has just been installed, has not been configured. My goal is to use pfSense as a proxy, but it is not permanent. I will eventually replace the SonicWALL with pfsense. And I will not need the pfSense in VMware as I have with a physical machine. When the physical machine is available, it will provide DHCP, proxy and firewall. But for now, only the proxy.

    The pfSense needs to be the only means of internet connection. But I can not do NAT interfaces. I'm testing at home and at work, so everything is working, I'll install pfSense in all branches spread out over the country.

    In two months, I will not have the SonicWALL anymore. By the end of the year, I will connect all branches with VPN, also using pfSense.

    I have no problem with Linux/iptables/Squid, but I want to use pfSense in this project.



  • iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j MASQUERADE
    echo 1 > /proc/sys/net/ipv4/ip_forward

    How do I convert it to pfSense?

    eth0 = em0


  • Netgate Administrator

    It's easy enough to use the virtualized pfSense to proxy connections to the virtualized Win 2008 server. Just create a virtual switch and connect the pfSense LAN interface and the server to it, all within vmware. However to proxy/firewall external clients you need to somehow connect the pfSense LAN interface to them and to do that you would need, at the very least, two NICs in the vmware host machine. Alternatively you could use VLANs to create the two interfaces but that is far more complex.

    The default configuration of pfSense will NAT connections between its WAN and LAN interfaces.

    How is your VMware configured internally? How is the Win7 machine connected?

    Steve



  • http://forums.freebsd.org/showthread.php?t=38937

    vmware not been modified.
    win2008 has a bridge interface
    the pfsense has two interfaces, NAT and bridged

    I want the pfsense is only used when connecting the Internet.
    I do not want to pass through the firewall on the local network.



  • Hi, Abhay here from FreeBSD forums.

    Here is my working NAT Config, Check out Picture. :)

    But in your situation it will not work because traffic will not come on your firewall that is destined for Windows machine in first place.
    How you will filter it?

    In order to use it to when connecting to internet you will have to configure it as default gateway for your machines either via dhcp(which pfsense) can handle.

    iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j MASQUERADE
    echo 1 > /proc/sys/net/ipv4/ip_forward

    From pfSense web interface Under firewall settings NAT outbound you will be able to configure that.
    This will not work sinse All traffic will directly come to Windows 2008 server and not pfsense.

    vmware not been modified.

    you will have to modify VMWare settings in order to achieve desired result.




  • I use vmware player.

    I wanted to configure pfsense as a proxy, just add a machine to test the proxy.

    Using Internet Explorer, set the proxy IP and port (bridge interface).

    And redirect to the NAT interface.

    Without touching the router (SonicWALL), a proxy is not official, it's just for testing.

    The company has the VMware ESXi, but is on the server, where I do not have permission to access.



  • I'm using the IP range 192.168.0, 192.168.1, 192.168.2


  • Netgate Administrator

    Ah, well you may be able to do that. I've never tried it though.
    If you setup pfSense will only a single interface (an interface bridged to the real NIC) then it will be given an IP by the Sonicwall (or use static IP). Then install the Squid proxy. Point your clients at the proxy IP/port. Install Squidguard if you want to filter traffic by URL.

    A setup like that works for testing purposes but offers nothing by way of security.

    If that's not what you're trying to do perhaps draw a diagram.  ;)

    Steve

    Edit: Just read the FreeBSD thread. Are you wanting to proxy all clients on your LAN or just the Win 2008 VM?



  • Traffic on the local network is very high.

    If everything is going through pfsense, I have to use fiber optics.

    I have several servers on the network. file server, sql, tecnix, etc..

    pfsense will only filter the internet connections.

    em0 - WAN - interface NAT - 192.168.248.128 (DHCP)
    em1 - LAN - interface bridge - 192.168.0.128 (DHCP)

    configure the browser to connect to the proxy.


  • Netgate Administrator

    Ah, so the Win7 host machine has two NICs?

    Steve



  • No, only one interface.

    Edit: changed the picture.



  • I can modify the vmware.

    I have to create more interfaces? or remove.


  • Netgate Administrator

    The easiest way to test the proxy would be as I described above. Have only a single interface on pfSense. Install Squid on pfSense. Since you have only one interface it will be open to any connection so can then just point any of your external clients browsers at it.

    You could use the the Win2008 VM as your test client inside VMware. See Case1 pic.

    You could create a new VM to use as a test client, Windows * or Linux, whatever. See Case2 pic.

    A better but much more complex setup would be to use VLANs to bring two interfaces into the VMWare environment. That way you could truly separate some, or all, clients and force them to use the proxy. See Case3 pic.

    What are you wanting to test?

    Steve








  • in case3.

    what setting I have to do?

    LAN to WAN and WAN to LAN?

    I have to do NAT 1:1?


  • Netgate Administrator

    The settings required for case 3 would depend on how you want the network to function. For example by default a two interface setup like that, WAN and LAN, will NAT between the two interfaces and serve DHCP and DNS requests on the local LAN. A pretty standard soho router setup. However your Sonicwall device is likely already doing that and you may not want a double NAT setup. In that case you may want to disable NAT altogether.

    If you have never used pfSense before I suggest you first simply add another VM as in case 2. When you are happy with the proxy setup and more familiar with pfSense in general then you can move to a more complex setup.

    To be honest this is outside my expertise. I only chimed in here because no-one else was and it was in 'General Questions'. Anyone more familiar with VLANs in VMWare please feel free to contribute.  ;)

    Steve



  • I need to connect PCs in the proxy.

    the more difficult it is to redirect to another interface (NAT) to access the internet.



  • Can i just tell you how I virtualise my Pfsense installation.

    So the internet goes into a router provided by the ISP….

    Ok one cable from there goes into my server into a pysical NIC

    I then create a Virtual switch Called "WAN" and assign the phsical Nic to that network.

    I then create another Virtual Switch called "Network" and assign a phsical NIC to it. This NIC is plugged into a switch where the rest of computers reside.

    Now i create a Pfsense Virtual machine add 2 V Nics. One is called WAN And assigned to the WAN VSwitch and another called LAN assigned to the Network VSwitch.

    All my other virtual servers would just get assigned to the Vswitch "Network" so they can all route and go out via Pfsense.

    That i think is simple!. Doing what you are doing could be a waste of time Because as soon as a device or new computer joins the network, it maybe able to skip the PFsense proxy. By doing my setup your forcing everyone through the pfsense proxy.



  • craigduff's setup works, but needs two physical interfaces. The cost of the extra interface may be worth the headaches it saves.

    So does stephenw10's case 3. If you have some real, critical reason to stay with only one physical interface to the machine running the VMs, you need a smart switch, with VLAN ability as part of its smarts. Here is some detail about how you'd set up version 3 if not running in fear of VLANs.

    If WAN is port 1, VM is port 2, and ports 3 to n are the other machines,

    VLAN 1 is ports 1 & 2. Port 1 is untagged. [this is set up ON THE SWITCH]

    VLAN 256 is ports 2 through n, and ports 3 through n are untagged. [this is set up ON THE SWITCH]

    Port 2 is the only port that is tagged (VLAN information leaves the switch.) That's because it's the only physical port carrying two virtual networks. [this is set up ON THE SWITCH]

    Ports 3 through n cannot see the WAN, so they have to speak to the pfsense on port 2.

    1 and 256 could be 1 & 2, 1 & 257, doesn't matter, but most switches like one of the VLANs to be 1. I suppose it would be more secure for many switches to set up VLAN1 as only applying to the port you'd like to manage the switch from, so you might want 3 VLANS, or not to use VLAN1 for the WAN port.

    On the VM you connect VLAN1 to the pfsense WAN, and VLAN 256 to the pfsense LAN, and the Windows LAN [this is set up ON THE VM and in pfsense on the VM]

    You cannot do this (at least not well and securely) with a dumb switch.



  • if only 1 interface is used
    bridge that nic to vmware and then in your settings add two network adapters
    and select that bridge nic

    i'm not familiar with vmware player.
    but in workstation this is what i do.

    1. go to network editor, bridge nic in vmnet0
    2. assuming you finish creating a vm, go to settings and add two network adapters
    3. select custom, and point to vmnet0 where the pysical nic is bridged to both network adapters

    network adapter1 -> custom - vmnet0 - bridged to physical nic
    network adapter2 -> custom - vmnet0 - bridged to physical nic


  • Netgate Administrator

    How are you suggesting the two virtual NICs be connected to the pfSense VM? If they are both bridged to the same real NIC then they can't be assigned as WAN and LAN as they would both be in the same subnet.

    Steve



  • I have set up pfsense as a dynamic SOCKS proxy, OpenVPN server and PPTP server long ago using VMplayer for testing and it worked fine, although adds zero security. I was just in it to test out the various functions at that point.  I assume squid will work also this way.  (also a good way to send someone a ready made VPN if you have no physical access to their system but do have remote desktop)

    What I did is install wmplayer.
    Install the latest full release (like 2.03 today)
    Make the VM so that :
          Network is bridge and replicating physical NIC state for WAN.
          Another virtual network interface to use as lan. (Not Bridged!)
          1 core (2 is better)
          512MB ram (you can experiment with less)

    After I booted, I'm locked out because I only have a WAN but no LAN I can access unless I make another VM of windows or something to use a virtual interface.  More resources…  So, no.

    I went into the VM shell command interface.

    pfctl -d

    Now the firewall is down, so I can go in at the WAN interface of your pfsense (assigned by DHCP by your other router) and deactivate "block private IPs on WAN" and I can also open my port 80 and 443 3128 and whatever other service ports you will need in the firewall rules under the WAN interface tab.
    Disable DNS Rebinding Checks also.

    Back to the pfsense command line interface
    pfctl -e

    Now your PFsense VM interface is accessible through its wan via your physical computers.  You can set up VPN, Proxy or whatever services you like.
    You can use it as a proxy for anything on the LAN or from outside on the internet also.  If you plan to access your vmplayer install of pfsense from the internet, you can you just have to forward ports from your first router to whatever IP pfsense gets from it.
    Stephenw10's way is better than this if your hardware supports VLANs and his way also frees up some hardware. 
    But you will need a better hypervisor than vmplayer.

    For me this worked fine but it was just for testing for me until I decided to just install pfsense on hardware as my router/firewall.
    Try that last part out. It works best.  Just replacing sonicwall with pfsense in the end is better.