Basic DMZ routing



  • Hi there,

    I'm having some serious bother setting up a DMZ using a transparent bridge.

    My aim is to produce a DMZ network on which I can provide public IPs to my servers. I have been assigned a /29:

    xxx.xxx.184.192 - Network
    xxx.xxx.184.193 - Gateway (provided by my ISP)
    xxx.xxx.184.194 - pfSense box
    xxx.xxx.184.195 - reserved for Server 1
    xxx.xxx.184.196 - reserved for Server 2
    xxx.xxx.184.197 - reserved for Server 3
    xxx.xxx.184.198 - reserved for Server 4
    xxx.xxx.184.199 - Broadcast
    
    WAN ---> pfSense (xxx.xxx.184.194) ---> LAN (192.168.1.1/24) ---> irrelevant
                                       ---> DMZ (192.168.145.1)  ---> Server 1 (xxx.xxx.184.195)
                                                                 ---> Server 2 (xxx.xxx.184.196)
                                                                 ---> Server 3 (xxx.xxx.184.197)
                                                                 ---> Server 4 (xxx.xxx.184.198)
    

    First up, I disabled the pfSense firewall (in the advanced options - "Disable all packet filtering.") for debugging purposes.

    I thenfollowed the instruction at http://blog.cycomptec.com/bridge-pfsense-firewall-public-private-ips-connected-dmz.
    I set the DMZ interface to have "None" IPv4 configuration type, and assigned 192.168.145.1 to the DMZ-Bridge interface (called BridgeDHCP in the guide).

    I then attached Server 1 to the DMZ network and assigned it a public IP and set it's default route to be the pfSense box.
    This gives us the following:

    
    root@box:~# ifconfig eth0 xxx.xxx.184.195 netmask 255.255.255.248
    
    root@box:~# route add default gateway xxx.xxx.184.194
    
    root@box:~# ifconfig
    eth0	Link encap: Ethernet	HWaddr [removed]
    	inet addr: xxx.xxx.184.195 Bcast xxx.xxx.184.199 Mask: 255.255.255.248
    	[...]
    
    root@box:~# route
    Kernal IP routing table
    Destination	Gateway		Genmask		Flags	Metric	Ref	Use	Iface
    default		xxx.xxx.184.194	0.0.0.0		UG	0	0	0	eth0
    127.0.0.1	*		255.255.255.255	UH	0	0	0	lo
    xxx.xxx.184.192	*		255.255.255.248	U	0	0	0	eth0
    
    

    At this point, I can ping the pfSense public IP (xxx.xxx.184.194) and it's private IP (192.168.145.1). I cannot ping the ISP provided gateway (xxx.xxx.184.193).

    To debug, I ran a traceroute. Packets seem to be getting as far as the pfSense box then stopping.

    
    root@box:~# traceroute 8.8.8.8
    traceroute to 8.8.8.8(8.8.8.8), 30 hops max, 38 byte packets
     1	xxx.xxx.184.194 (xxx.xxx.184.194)	0.296ms	0.234ms	0.184ms
     2	*	*	*
     3	*	*	*
    
    

    Does anybody have any idea why my packets are stopping, and how I can get my servers talking to the wider internet?

    Edit: it gets worse…
    It appears that this configuration is unstable for some reason and Server 1 can only ping the pfSense box intermittently and traceroutes are failing on hop 1 now. This may be a symptom of poor configuration or a whole other issue, but I feel it is relevant.

    Thanks!

    • Grey

Log in to reply