Noobie Q about routing (ver 2.0.3-Release)

gurvindernarula

Hello all,

I'm new to pfSense so this could be a very basic question, but I'm baffled about how routing is working in my environment.

My setup is as follows :

+–---------------+
| Internet Router |
| (AT & T uVerse) |
+-----------------+
^
|
v <-WAN
+------------------+
| pfSense Firewall |
| 172.16.0.1 | <---> LAN (172.16.0.0/24)
| 192.168.0.1 | <---> DMZ (OPT1 - 192.16.0.0/24) - Not yet a true DMZ - I'm running some tests before I 'expose' any ports to the public Internet.
+------------------+

I've not change the LAN and WAN rules that pfSense configured 'out-of-the-box' (OTB).

On the DMZ side, I've configured the rule just like the LAN side (Action : Pass, Protocol : Any, Source : DMZ Net, Source Port : Any, Destination : Any, Destination Port : Any).

I've also left the default OTB Routing as-is : Name : WAN, Interface WAN, IP Address : My external (public) IP Address assigned via DHCP by my ISP.

I'm able to 'ping' different computers between the 2 subnets without any issues.

The issue comes up when I try to do a trace-route. The trace seems to indicate that my packets are going all over the Internet before reaching my server. e.g. when I try to traceroute from 172.16.0.17 (on the LAN) to 192.168.0.10 (on the DMZ), I get the following results :

C-Prompt:>tracert 192.16.0.10

Tracing route to 192.16.0.10 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 172.16.0.1
2 * * * Request timed out.
3 46 ms 26 ms 27 ms my-IP-Address.domain-assigned-by-ISP
4 * * * Request timed out.
5 29 ms 28 ms 27 ms 75.26.64.14
6 * * * Request timed out.
7 27 ms 27 ms 27 ms 12.83.32.173
8 36 ms 33 ms 35 ms ggr4.cgcil.ip.att.net [12.122.133.33]
9 33 ms 33 ms 33 ms chi-bb1-link.telia.net [213.248.87.253]
10 34 ms 78 ms 33 ms edgecast-ic-157045-chi-bb1.c.telia.net [62.115.9
.130]
11 34 ms 33 ms 34 ms 198-7-19-109.edgecastcdn.net [198.7.19.109]
12 32 ms 33 ms 32 ms 192.16.0.10

Is this normal ? It does take quite a while for me to invoke any services between the computers on the different sub-nets.

What am I doing wrong ?

Thanks in advance,
Gurvinder

phil.davis

If its not just a typo, then this is your problem:

12    32 ms    33 ms    32 ms  192.16.0.10

192.16.0.10 is a real public IP.
It should be 192.168.0.10 (look for the missing "8" anywhere on the OPT1 setup, and systems in the OPT1 subnet)

gurvindernarula

:-[ - Duh …...

Thanks that was it - it was a typo -

mikeisfly

Another thing,

Isn't the purpose of a DMZ to keep that traffic segregated from the rest of your network? You should create a rule on your DMZ to block all traffic going to any LAN IP and make sure its before that allow any any rule.