Access DMZ to WAN

jordan49

Hi all,

I would like to have an access in DMZ to the WAN. My interfaces are :

LAN : 10.0.0.50/8
- PC : 10.0.0.10 => Access WAN OK
Gateway : 10.0.0.50
Dns Server : 10.0.0.50

DMZ : 10.0.1.50/8
- PC : 10.0.1.1 => Access WAN down
Gateway : 10.0.1.50
Dns Server = 10.0.0.50

WAN : 192.168.0.5/24

I have created a rule like the lan rule for the WAN:

DMZ rules :

* DMZ net * * * * (Access to WAN)

UDP DMZ net * 10.0.0.50 53 (DNS) * (Access to DNS server in LAN)

but the access to WAN since DMZ is always down, i have read the docs monowall but it's the same problem.

Thanks for your help

GruensFroeschli

LAN : 10.0.0.50/8
DMZ : 10.0.1.50/8

The same subnet on two interfaces wont work.

jordan49

Ok, now the subnet of DMZ is /16 but access to WAN doesn't work…
-PC :
Ip adress : 10.0.1.1
Subnet : 255.255.0.0
Gateway : 10.0.1.50
DNS : 10.0.0.50

Interface DMZ in Pfsense :
10.0.1.50/16

GruensFroeschli

I suggest you start reading on wikipedia how subnetting works.
10.0.0.0/16 is still the same subnet as 10.0.1.0/16

jordan49

I don't understand because in the monowall documentation http://doc.m0n0.ch/handbook/examples.html#id11622455 Lan ip address is : 192.168.1.1/24 and Dmz ip adress :192.168.2.1/24, the subnet is the same…

GruensFroeschli

192.168.1.1/24 and 192.168.2.1/24 are two different subnets!

You seem to missinterpretate the "/number"
192.168.0.0/24 is equal to 192.168.0.0 to 192.168.0.255
192.168.1.0/24 is equal to 192.168.1.0 to 192.168.1.255

10.0.0.0/8 is equal to 10.0.0.0 to 10.255.255.255
10.0.0.0/16 is equal to 10.0.0.0 to 10.0.255.255

The number in CIDR notation behind the / is how many bits are for the "network" identification.
The rest of the bits (32 - number behind /) are the bits for the addressing within the subnet.

So really read a bit on your own how the basics work.
http://en.wikipedia.org/wiki/Subnetwork
http://en.wikipedia.org/wiki/CIDR

jordan49

Ok, so now my Dmz ip address is : 10.1.0.50/16 (network : 10.1.0.0)
Lan ip address is : 10.0.0.50/8 (network : 10.0.0.0)

I don't have an access to WAN…

jordan49

I take the dns adress of my freebox and the wan is now ok since my dmz…

Thank you GruensFroeschli

GruensFroeschli

Your addresses are still conflicting

10.0.0.50/8
is 10.0.0.0 up to 10.255.255.255

which contains

10.1.0.50/16
which is 10.1.0.0 to 10.1.255.255

Just set your first subnet to /16 too and it should work.
–>
10.0.0.0/16
10.1.0.0/16

jordan49

Ok ty for the tip, i have a new problem ^^, in my dmz i have a apache server on port 80 but is it inacessible from the wan.
10.1.0.1 is the server ip address.

In Firewall: NAT: 1:1 i have the rule :

Interface External IP Internal IP Description
WAN 192.168.0.10/32 10.1.0.1/32 www

And in port forwad :
If Proto Ext. port range NAT IP Int. port
WAN TCP 80 (HTTP) 10.1.0.1 80 (HTTP)
(ext.: 192.168.0.5)

But when i want to connect to 192.168.0.10 it's down.

GruensFroeschli

You dont use 1:1 NAT and normal forwardings.
One or the other.

In your forwarding rule you have as ext: 192.168.0.5.
Are you sure that your WAN interface is 192.168.0.10 and not 192.168.0.5?
Also if you want to forward port 80 of your WAN, make sure that you change the webgui to something else.

jahonix

If WAN is on a private subnet (like 192.168. is) you have to disable 'block private subnets' as well.
What's in front of your WAN anyway?

jordan49

this work perfectly thank a lot of !