Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cant split my 8 IP subnet between WAN and DMZ, routing problem

    Scheduled Pinned Locked Moved
    HA/CARP/VIPs
    2
    3
    5.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dzezik
      last edited by

      my ISP gives me 8 IP subnet
      lets x.y.z.192/29
      i used hardware firewall before and now plan to switch to pfsense
      i am testing configuration on vmWare
      here is my configuration
      x.y.z.192 is my net
      x.y.z.193 is my dsl modem and my gateway
      x.y.z.194 will be main pfsense IP (WAN)
      i would like to have 195,196,197,198 IPs on DMZ
      it should be easy with bridging, but this configuration lacks traffic shapping
      so i decided  to use proxy ARP too split my 8ip network into two segments:
      here is how i am doing this (it worked fine on my old hardware router firewall)
      1. interfaces
          WAN: IP:x.y.z.194/32 gateway:x.y.z.193
          DMZ: IP x.y.z.194/29
      2. Virtual IPs (proxy ARP):
          WAN: x.y.z.193/32
          DMZ: x.y.z.192/29
      3. routing (most important)
        i need this routes to work
        x.y.z.193/32 WAN
        x.y.z.194/32 WAN
        x.y.z.192/29 DMZ
        0.0.0.0/0 x.y.z.193 WAN

      routing is problem on pfSense because U do not control it yourself, pfsense generate routes behind
      so I can add static routes but it needs IP gateway, and this is not the route type i need
      pfSense generates routes like this:
      x.y.z.193/32 DMZ - it is wrong it should be WAN
      x.y.z.194/32 lo - it means only loopback - wrong route - should be WAN
      x.y.z.192/29 DMZ O.K.
      default gateway DMZ - i can not understand why but pfsense makes default route on DMZ, it should on WAN

      there is information on system log:
      kernel: arpresolve: can't allocate route for x.y.z.194
      kernel: arplookup x.y.z.194 failed: host is not on local network

      maybe i should change this routes directly in os
      but i am afraid it can be altered by pfsense later without any information

      and I am a little confused with BSD configuration

      it would be nice to let change routes with webGui

      Grzegorz Zal

      1 Reply Last reply Reply Quote 0
      • H
        hoba
        last edited by

        You can't have this kind of config as it has too many conflicts.  What you want to do instead is have the complete subnet at wan and create Virtual IPs for all the additional IPs. Then use portforwards or 1:1 NAT to map the additional IPs tot he DMZ machines. DMZ will have a provate IP subnetrange.

        1 Reply Last reply Reply Quote 0
        • D
          dzezik
          last edited by

          thanks for advice, I will try this, but this is not as elegenat, i want my 4 hosts on DMZ to have public adresses configured. i treat NAT 1:1 as more complicated than my desired configuration.
          My configuration is more elegant and simpler but unfortunatelly pfSense has problems with advanced routing (there is no routing option at all), it is rather advanced firewall and very simple router.
          I wonder (will testing) if DMZ and WAN can use the same addreses and be NATed 1:1
          i mean x.y.z 195 on DMZ nated to virtual IP x.yz.195 on WAN
          this will be very sophisticated and complicated but it will look like my desired configuration for hosts in DMZ.

          pfSense lack routing. You have no control on routing in pfSense but You can change routing in shell.
          I tried to do my routing. IT support it, You can make any of routes I described using route command, even can control proxy ARP.
          but one i cannot override:

          this freeBSD do not accept default route gateway x.y.z.193 on WAN (le0)
          when I insert route giving -interface le0 it shows "route: bad address: le0"
          when I ommit interface i got strange route
          0&0xc0a800002 link#3 UCS 0 0 le2
          this route is wrong because use wrong interface and is difficult to alter or delete
          but when I leave original default an only make change to it
          route -d change 0.0.0.0. interface le0
          i get
          default            00:0c:29:8a:d1:f9  UGS        0        4    le0 (this is good, my gateway is on le0)
          and it worked fine for few minutes (this is mac for le0 WAN interface) and then it hangs and i did not get the same result after restart
          even using the same command

          it looks like my configuration Is perfectly coorect buy freeBSD do not gives You full control on routing

          the main problem is that my gateway is on WAN but its addres is covered by DMZ subnet
          so setting this gateway as default implicit make default route on DMZ
          using explicit WAN interface is not accepted by freeBSD
          i think it is kind of BUG
          i public this gateway using proxy ARP on WAN, so it should accept it !!!

          but when i force freeBSD for correct route table i wonder what will the firewall do

          Im not good in network configurationin BSD/linux
          but maybe should make sophisticaed /etc/rc.conf to make  routes permanent
          and avoid changes made by pfsense

          and wait for 1.3 release
          maybe they will fix problem with traffic shaper in bridge mode (does not work in 1.2)
          so then i will just bridge WAN and DMZ
          it is simplest way to get my configuration

          1 Reply Last reply Reply Quote 0
          • First post
            Last post