Pf problem using with transparent proxy



  • Hi there,

    I have been trying to implement Pfsense 2.0.3 and replacing the linux box. My topology is simple but having a redirection problem with firewall. Here is my network;

    DSL (wan) -> bge0_vlan13 -> 172.16.33.2
    LAN (lan) -> bge0_vlan10 -> 128.1.9.7
    ASO (opt1) -> bge0_vlan12 -> 10.14.27.10
    ovpnc1 -> 10.0.3.2

    I use site2site vpn between two locations (128.1.9.0/24 and 128.1.1.0/24) via openvpn and squid with transparent proxy. Everything works properly except below;

    Pfsense's default gateway is 172.16.33.1 (DSL) and Openvpn is running on 10.14.27.10 (ASO). When i select "Transparent proxy" check-box, pfsense adds a rule like this;

    pass in quick on bge0_vlan10 proto tcp from any to ! (bge0_vlan10) port = 3128 flags S/SA keep state

    This is fine but i have web servers on my other vpn site and can not access them via squid because squid sends all traffic via DSL interface. I wanted to add a rule like this but did not work;

    [2.0.3-RELEASE][admin@fw]/root(20): pfctl -sa -r -vvv | grep 3128
    @3 rdr on bge0_vlan10 inet proto tcp from 128.1.9.0/24 to ! 128.1.1.0/24 port = http -> 127.0.0.1 port 3128
    @4 rdr on bge0_vlan10 inet proto tcp from any to ! (bge0_vlan10:1) port = http -> 127.0.0.1 port 3128

    I am expecting from pfsense that do not forward tcp/80 when i go to 128.1.1.0/24. Even though i add this rule firewall still sends traffic over vpn tunnel ip;

    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on ovpnc1, link-type NULL (BSD loopback), capture size 96 bytes
    00:00:00.000000 AF IPv4 (2), length 64: 10.0.3.2.1827 > 128.1.1.18.80: Flags ~~, seq 1026882908, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 12396120 ecr 0], length 0

    Can anyone tell me a way to fix it?

    Regards.

    ismail.~~


Log in to reply