Basic DMZ routing

  • Hi there,

    I'm having some serious bother setting up a DMZ using a transparent bridge.

    My aim is to produce a DMZ network on which I can provide public IPs to my servers. I have been assigned a /29: - Network - Gateway (provided by my ISP) - pfSense box - reserved for Server 1 - reserved for Server 2 - reserved for Server 3 - reserved for Server 4 - Broadcast
    WAN ---> pfSense ( ---> LAN ( ---> irrelevant
                                       ---> DMZ (  ---> Server 1 (
                                                                 ---> Server 2 (
                                                                 ---> Server 3 (
                                                                 ---> Server 4 (

    First up, I disabled the pfSense firewall (in the advanced options - "Disable all packet filtering.") for debugging purposes.

    I thenfollowed the instruction at
    I set the DMZ interface to have "None" IPv4 configuration type, and assigned to the DMZ-Bridge interface (called BridgeDHCP in the guide).

    I then attached Server 1 to the DMZ network and assigned it a public IP and set it's default route to be the pfSense box.
    This gives us the following:

    root@box:~# ifconfig eth0 netmask
    root@box:~# route add default gateway
    root@box:~# ifconfig
    eth0	Link encap: Ethernet	HWaddr [removed]
    	inet addr: Bcast Mask:
    root@box:~# route
    Kernal IP routing table
    Destination	Gateway		Genmask		Flags	Metric	Ref	Use	Iface
    default		UG	0	0	0	eth0	*	UH	0	0	0	lo	*	U	0	0	0	eth0

    At this point, I can ping the pfSense public IP ( and it's private IP ( I cannot ping the ISP provided gateway (

    To debug, I ran a traceroute. Packets seem to be getting as far as the pfSense box then stopping.

    root@box:~# traceroute
    traceroute to, 30 hops max, 38 byte packets
     1 (	0.296ms	0.234ms	0.184ms
     2	*	*	*
     3	*	*	*

    Does anybody have any idea why my packets are stopping, and how I can get my servers talking to the wider internet?

    Edit: it gets worse…
    It appears that this configuration is unstable for some reason and Server 1 can only ping the pfSense box intermittently and traceroutes are failing on hop 1 now. This may be a symptom of poor configuration or a whole other issue, but I feel it is relevant.


    • Grey

Log in to reply