Pfsense + vmware

dgiorgio

I have this network structure

modem <–----> router <----> switch <-----> servers / computers

I have a machine with win7, and running vmware with 1 network card.

in vmware, I have windows 2008 and another vm with pfsense doing firewall / proxy.

how do I pass by every network pfsense when accessing the internet?

I'll have to configure the switch? need to have 2 virtual interfaces in pfsense?

this is feasible network structure?

robi

@dgiorgio:

how do I pass by every network pfsense when accessing the internet?

The question is hard to understand. Please rephrase your question.

dgiorgio

I have a physical machine with windows 7 and connected to the switch.

this machine is installed vmware.

in vmware, I have windows 2008 and pfsense
windows 2008 is running AD and DNS.
pfsense is running firewall and proxy.

all other machines are connected to the switch.

these machines do login with AD in windows 2008.

how do I get all the machines pass through pfsense "firewall / proxy"?

stephenw10

You will need some sort of vlan setup in order to protect the external machines. pfSense requires 2 interfaces, virtual or otherwise, to function as a firewall.

Steve

dgiorgio

I have two virtual interfaces, nat and bridge.

em0 - WAN - interface NAT
em1 - LAN - interface bridge

how to share internet from wan to lan?

dgiorgio

I will put my network structure in more detail.

2x modem <–----> router(sonicwall) <----> switch <-----> servers/computers
All machines are connected to the switch.

I have a machine with VMware. In VMware I have Windows 2008r2 and pfSense. The pfSense has just been installed, has not been configured. My goal is to use pfSense as a proxy, but it is not permanent. I will eventually replace the SonicWALL with pfsense. And I will not need the pfSense in VMware as I have with a physical machine. When the physical machine is available, it will provide DHCP, proxy and firewall. But for now, only the proxy.

The pfSense needs to be the only means of internet connection. But I can not do NAT interfaces. I'm testing at home and at work, so everything is working, I'll install pfSense in all branches spread out over the country.

In two months, I will not have the SonicWALL anymore. By the end of the year, I will connect all branches with VPN, also using pfSense.

I have no problem with Linux/iptables/Squid, but I want to use pfSense in this project.

dgiorgio

iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

How do I convert it to pfSense?

eth0 = em0

stephenw10

It's easy enough to use the virtualized pfSense to proxy connections to the virtualized Win 2008 server. Just create a virtual switch and connect the pfSense LAN interface and the server to it, all within vmware. However to proxy/firewall external clients you need to somehow connect the pfSense LAN interface to them and to do that you would need, at the very least, two NICs in the vmware host machine. Alternatively you could use VLANs to create the two interfaces but that is far more complex.

The default configuration of pfSense will NAT connections between its WAN and LAN interfaces.

How is your VMware configured internally? How is the Win7 machine connected?

Steve

dgiorgio

http://forums.freebsd.org/showthread.php?t=38937

vmware not been modified.
win2008 has a bridge interface
the pfsense has two interfaces, NAT and bridged

I want the pfsense is only used when connecting the Internet.
I do not want to pass through the firewall on the local network.

abhay4589

Hi, Abhay here from FreeBSD forums.

Here is my working NAT Config, Check out Picture. :)

But in your situation it will not work because traffic will not come on your firewall that is destined for Windows machine in first place.
How you will filter it?

In order to use it to when connecting to internet you will have to configure it as default gateway for your machines either via dhcp(which pfsense) can handle.

iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

From pfSense web interface Under firewall settings NAT outbound you will be able to configure that.
This will not work sinse All traffic will directly come to Windows 2008 server and not pfsense.

vmware not been modified.

you will have to modify VMWare settings in order to achieve desired result.

PFsenseNAT.png_thumb

dgiorgio

I use vmware player.

I wanted to configure pfsense as a proxy, just add a machine to test the proxy.

Using Internet Explorer, set the proxy IP and port (bridge interface).

And redirect to the NAT interface.

Without touching the router (SonicWALL), a proxy is not official, it's just for testing.

The company has the VMware ESXi, but is on the server, where I do not have permission to access.

dgiorgio

I'm using the IP range 192.168.0, 192.168.1, 192.168.2

stephenw10

Ah, well you may be able to do that. I've never tried it though.
If you setup pfSense will only a single interface (an interface bridged to the real NIC) then it will be given an IP by the Sonicwall (or use static IP). Then install the Squid proxy. Point your clients at the proxy IP/port. Install Squidguard if you want to filter traffic by URL.

A setup like that works for testing purposes but offers nothing by way of security.

If that's not what you're trying to do perhaps draw a diagram. ;)

Steve

Edit: Just read the FreeBSD thread. Are you wanting to proxy all clients on your LAN or just the Win 2008 VM?

dgiorgio

Traffic on the local network is very high.

If everything is going through pfsense, I have to use fiber optics.

I have several servers on the network. file server, sql, tecnix, etc..

pfsense will only filter the internet connections.

em0 - WAN - interface NAT - 192.168.248.128 (DHCP)
em1 - LAN - interface bridge - 192.168.0.128 (DHCP)

configure the browser to connect to the proxy.

stephenw10

Ah, so the Win7 host machine has two NICs?

Steve

dgiorgio

No, only one interface.

Edit: changed the picture.

dgiorgio

I can modify the vmware.

I have to create more interfaces? or remove.

stephenw10

The easiest way to test the proxy would be as I described above. Have only a single interface on pfSense. Install Squid on pfSense. Since you have only one interface it will be open to any connection so can then just point any of your external clients browsers at it.

You could use the the Win2008 VM as your test client inside VMware. See Case1 pic.

You could create a new VM to use as a test client, Windows * or Linux, whatever. See Case2 pic.

A better but much more complex setup would be to use VLANs to bring two interfaces into the VMWare environment. That way you could truly separate some, or all, clients and force them to use the proxy. See Case3 pic.

What are you wanting to test?

Steve

Case1.jpg_thumb

Case2.jpg_thumb

Case3.jpg_thumb

dgiorgio

in case3.

what setting I have to do?

LAN to WAN and WAN to LAN?

I have to do NAT 1:1?

stephenw10

The settings required for case 3 would depend on how you want the network to function. For example by default a two interface setup like that, WAN and LAN, will NAT between the two interfaces and serve DHCP and DNS requests on the local LAN. A pretty standard soho router setup. However your Sonicwall device is likely already doing that and you may not want a double NAT setup. In that case you may want to disable NAT altogether.

If you have never used pfSense before I suggest you first simply add another VM as in case 2. When you are happy with the proxy setup and more familiar with pfSense in general then you can move to a more complex setup.

To be honest this is outside my expertise. I only chimed in here because no-one else was and it was in 'General Questions'. Anyone more familiar with VLANs in VMWare please feel free to contribute. ;)

Steve