Pf problem using with transparent proxy
-
Hi there,
I have been trying to implement Pfsense 2.0.3 and replacing the linux box. My topology is simple but having a redirection problem with firewall. Here is my network;
DSL (wan) -> bge0_vlan13 -> 172.16.33.2
LAN (lan) -> bge0_vlan10 -> 128.1.9.7
ASO (opt1) -> bge0_vlan12 -> 10.14.27.10
ovpnc1 -> 10.0.3.2I use site2site vpn between two locations (128.1.9.0/24 and 128.1.1.0/24) via openvpn and squid with transparent proxy. Everything works properly except below;
Pfsense's default gateway is 172.16.33.1 (DSL) and Openvpn is running on 10.14.27.10 (ASO). When i select "Transparent proxy" check-box, pfsense adds a rule like this;
pass in quick on bge0_vlan10 proto tcp from any to ! (bge0_vlan10) port = 3128 flags S/SA keep state
This is fine but i have web servers on my other vpn site and can not access them via squid because squid sends all traffic via DSL interface. I wanted to add a rule like this but did not work;
[2.0.3-RELEASE][admin@fw]/root(20): pfctl -sa -r -vvv | grep 3128
@3 rdr on bge0_vlan10 inet proto tcp from 128.1.9.0/24 to ! 128.1.1.0/24 port = http -> 127.0.0.1 port 3128
@4 rdr on bge0_vlan10 inet proto tcp from any to ! (bge0_vlan10:1) port = http -> 127.0.0.1 port 3128I am expecting from pfsense that do not forward tcp/80 when i go to 128.1.1.0/24. Even though i add this rule firewall still sends traffic over vpn tunnel ip;
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ovpnc1, link-type NULL (BSD loopback), capture size 96 bytes
00:00:00.000000 AF IPv4 (2), length 64: 10.0.3.2.1827 > 128.1.1.18.80: Flags ~~, seq 1026882908, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 12396120 ecr 0], length 0Can anyone tell me a way to fix it?
Regards.
ismail.~~