Internet Access on 4 Segment Network using VMWare ESXi

[WTF]

Hi,

First off hello and thanks for writing such a quality app with great interface :)

I was hoping someone could help me with a small project I am working on -

Topology
WAN - 192.168.0.0/24
  WAN Router - 192.168.0.1 (doesn't support adding static routes, all 192.168.0.0 NATd behind its public IP)
  PFSense WAN Interface - 192.168.0.10
LAN - 10.0.0.0/24
  PFSense LAN Interface - 10.0.0.1
  Domain Controller - 10.0.0.10
UNTRUSTED - 10.50.0.0/24
  PFSense UT Interface - 10.50.0.1
  Test Server 10.50.0.10
DMZ - 10.10.0.0./24
  PFSense DMZ Interface - 10.10.0.1
  Web Server - 10.10.0.10

I can ping from PFSense to all the different nodes in each segment of the network and out to 8.8.8.8 which would make me think I have the gateway configured correctly.
I can ping from the Domain Controller to all different networks, Web Server, Test Server and WAN Router.  Though I cant ping 8.8.8.8

I thought this may have been a limitation of the WAN router only supporting 1 network so added a NAT rule to mask behind the WAN PFSense Interface IP but still didnt have any luck.

Anyone got any suggestions for me?

Thanks,
WTF

[podilarius]

If pfsense can ping 8.8.8.8, then it anything on any other NIC should be able to ping it if the proper FW and NAT rules are in place.
On the WAN, did you disable the blocking of private IPS?

[WTF]

Ahh I've spotted one mistake  :o  Protocol defaults to TCP not ANY and as ICMP != TCP that would be my problem ::)

I can now ping through and can see 10.0.0.10 to 8.8.8.8 echo request leaving the WAN interface but no reply.

I would suspect that is because 192.168.0.1 doesnt know about the 10.0.0.0 network.  As I cant add a static route, if I added an Outbound NAT (still on Automatic) rule with SRC:10.0.0.0/24 DST:* NATAddress:192.168.0.10 that should allow return traffic right?

Thanks.

[stephenw10]

If outboaund NAT is on automatic and you haven't disbaled it in any way then pfSense will NAT between any interfaces that have a gateway and those that don't. By default that would mean that NAT happens between WAN and LAN as long as you have a gateway on WAN, which it seems like you do. However if packets are leaving WAN still addressed as 10.X.X.X then translation is not happening.  :-\

Because your WAN is in a private address space your should have removed the check mark in the WAN setup from 'Block private networks', as podilarius asked.

Steve

[WTF]

Sorry I meant to say the "Block Private Networks" is unchecked.

Will the packet capture on the WAN interface show the translated packet i.e.

192.168.0.10 (from 10.0.0.10.) to 8.8.8.8

or will it show the original source address i.e.

10.0.0.10 to 8.8.8.8

From the way you worded it it should show the interface address when looking at a packet capture on the WAN interface?

[stephenw10]

I was sure until you just asked. Just tested it and now I'm really sure.  :)
It should show the WAN address on the leaving echo request if NAT is working.

Steve

[WTF]

Yea im new to pfsense but have been on Checkpoint SPLAT that a tcpdump doesnt show the NAT'd address in the re-written source address (I think it had something to do with the order that the packets are processed).  Hence me asking for clarification :)

I'll have a play around and check when I get home!