Pfsense setup in a university setting



  • I am new to setting up a firewall this way. I cannot figure out the NAT or rules to use

    I am working in a University setting.

    I have one web server hosting 2 sites on 2 static ip's xxx.xxx.xxx.188 and xxx.xxx.xxx.197
    and attached to AD so faculty can modify there personal sites on .188

    and a file server attached to an AD 2003 domain xxx.xxx.xxx.194

    my pfsense box has an ext ip of xxx.xxx.xxx.124 with one WAN and one LAN interface

    all are on the same subnet 255.255.255.0 and gateway xxx.xxx.xxx.254

    the web server has one NIC with 2 internal ip's setup up static as 192.168.100.2 and 192.168.100.3
    the file server has one NIC static internal 192.168.100.4

    dns and wins info comes from the university with pfsense 192.168.100.254 setup as LAN gateway

    outbound the servers have no problem
    inbound there is nothing http is screwed so is network access into the servers under windows networking

    I've tried 1:1 port forwarding firewall rules nothing wants to work

    please help. I may be vague on details in this post so ask if you need more info



  • NAT will seriously break Windows LAN networking capabilities. It sounds like your servers are inside the firewall, and the users and other servers are on the WAN side. Hence NAT is occurring between them. For something like this to work, you either must use bridging, or have a routed IP subnet for your internal interfaces.



  • all of my equipment hangs off the universities main network. My 2 servers need a firewall between them and this network. so how do i go about setting up a bridge or subnet on pfsense. I am only familiar with commercial boxes and this department can't afford one of those



  • An ASCII art network diagram and exactly what you're trying to achieve (what services do you need to provide) and why you're trying to restrict access would help.



  • Hello,

    I work in a spanish University. I have a network topology like yours, with now, everything working.

    If you still need help, I can help you.

    Bye


Locked