No DNS from DMZ
-
I've set up pfSense on an ESXi machine and added a DMZ as described in this article:
https://doc.pfsense.org/index.php/PfSense_2_on_VMware_ESXi_5
I've also set up a DMZ configuration as described here:
http://www.digitalphotomac.com/PFsense/DMZ/
The only difference is that I haven't followed the last step (since I don't want the DMZ network to talk to my internal DNS and instead go out to Google's DNS servers @8.8.8.8/8.8.4.4, which are set up as the default DNS servers for my pfSense installation) . I couldn't get the DMZ machines to talk to the internet at all until I added a a Firewall NAT rule to allow all traffic from the 192.168.2.0/24 network (my DMZ network) to the "any" network (I'm not sure if for security purposes I should have made that rule into the "not LAN" rule in the NAT list). I've also set up a DHCP server on the DMZ network that gives all the machines all the default options and the interface IP (192.168.2.1) as the Gateway. I'm thinking to just remove the DHCP all together since I will only have a handful of machines on that network.
I can ping the DMZ net from the LAN net but not vice-versa, even though it looks like the machines on the DMZ network understand my internal DNS (if I type "ping <hostname on="" internal="" network="">" the DMZ machine can't ping it but it recognizes the IP address). From the DMZ, I can ping the Google DNS servers, but not go to any website (like www.google.com).
Have I missed something when setting up the rules?</hostname>