Firewall setup

jeffstu · Apr 1, 2015, 4:34 PM

This may be in the wrong place. I apologize in advance if it is.

I am trying to set up PFsense as a firewall for my esxi installation.
so I have PF sense running on a VM and I currently have it working with 1 public ip and multiple vm's getting dhcp from pfsense.

I want to add in a few more public ip's and some vlans.

I currently have 1 virtual ip added.
and 2 vlans set up.
I can put vm's in those vlans and get them to get an ip address.
So far so good.

Now i want to be able to route a public ip to each vlan and provide routing/firewall for each vlan.

e.g.

ip1 > vlan 1 > DHCP/NAT > relevant VM. e.g. ip1 port xx22 to re-direct to vm1 on vlan1 on port 22
then ip1 on port xx389 to re-direct to vm2 on port 3389
ip2 > vlan 2 > DHCP/NAT > relevant vm. same example i guess but with ip2 on vlan2

Hope this is clear as it's quite hard to describe in text.

So far I managed to set up a 1:1 mapping for the virutal ip and have that route to a specific VM on specific vlan / port.
But not sure how or if it's possible to do what i'm trying to do where each vlan has it's own public IP and routes like it would in the origional setup.

I'd rather do it with 1 pfsense vm and vlans than a pfsense vm for each ip as that is the way a colleague first suggested seems like there would be a way to get this to work with 1 pfsense instance.

Thanks for the help in advance.
If I need to clear up any questions let me know.

Stu

jeffstu · Apr 2, 2015, 1:19 PM

Just to clear this up a bit as I realise the above is a bit confusing.

Currently have 3 public IP's
I'm planning on adding at least 5 more.

I have

vlan1
vlan2
and vlan(all)

all has ip1
vlan 1 has a 1:1 virtual ip for ip2 that points to vm1 on vlan1. Then Firewall rules on the WAN interface allow ports. ssh, http/https etc.
VLAN2 is the same 1:1 virtual ip for ip3 that poins to vm2 on vlan2. Then Firewall rules on the Wan interface to allow ports, RDP etc.

I believe I should be able to get traffic on each vlan to come in and go out on the specified ip for that vlan.
DHCP is currently working as i'd expect.
I'd like to be able to allow deny ports on the rules page for the vlan rather than on the WAN interface and be able to re-direct ports.
e.g. ssh come in on say ip2 on port 80022 to then re-direct to port 22 on vm1 on vlan1.

The end result I'd like to be able to hand a friend credentials to log into esxi with only access to vm's assigned to his vlan along with credentials for pfsense with the ability to edit rules for his VLAN.

Hope that makes sense.