Router only, no internet on OPT1



  • I'm running a pfsense box as router only with no firewall (disabled all packet filtering), but I don't seem to be able to access the WAN using OPT1, how do I do this ?
    I can ping hosts from all interfaces except for OPT1 (and vlans attached to it)



  • Please post your outgoing rules…normally this happens because you did not set outgoing NAT.


  • LAYER 8 Global Moderator

    When he says he turned off filtering I would assume there is no nat either?  Can you nat still if you turn off filtering?

    My guess would be that the network on opt1 is not known by the wan network.. Devices on the wan network would need to know how to get to the opt1 network.



  • No NAT, just using this one as a routing box from the LAN\VLANS to a smoothwall box then to the internet.

    Disabling the firewall seemed to fix the problems I had connecting to microsoft active directory from the smoothwall box for authentication but then it broke the routing on the VLANS on OPT1

    Id enable the firewall if I could work out how to get the Smoothwall talking to AD (I couldn't ping the AD servers from the WAN interface no matter what I did)


  • LAYER 8 Global Moderator

    I am not sure, but I would assume if you turn off filtering then you loose nat.  So you would have to setup routing on your devices on the wan how to get to your lan and opt1 networks.  OR setup a transit network between your router in front of pfsense to pfsense with routing to those networks.



  • Then I think I'll be better off turning the firewall off, but then I'm back to square one not being able to access the Active Directory from the wan unless there's a WAN rule that can fix that ?


  • Banned

    You can have no WAN (or any other interface) rules when you turn the packet filter off. If you do not want NAT, then disable NAT and not the packet filter. It is even written in the GUI notes next to the checkbox where you can disable the pf.


  • LAYER 8 Global Moderator

    ^ exactly the way to use pfsense as router is disable nat and create any any rules.



  • Thanks, I'll test it out - feel like I've been going round in circles these past few days!



  • You can have no WAN (or any other interface) rules when you turn the packet filter off.

    ^ exactly the way to use pfsense as router is disable nat and create any any rules.

    Well, which is it?  No rules or Any:Any rules?  Or did you mean there must be no rules when the filter is disabled but then after you need to add Any:Any rules???


  • LAYER 8 Global Moderator

    Those are 2 different people saying things that you put into 1 quote.

    How I would use pfsense as router would be turn off nat and then any any.  You could then log traffic if you wanted in your any any rules, etc.  Or create rules just for logging even better.  You could still use the limiters, etc.

    If you just going to turn off filtering and route - might as well just put in a L3 switch.



  • Those are 2 different people saying things that you put into 1 quote.

    Yes, I know, was done for brevity.  But you agreed with dok after saying something completely opposite.  He says no rules, you say any:any.



  • Wish I could just put a L3 switch in would save me the problems, as it is it's cheaper for me to use a pfsense as a router instead


  • LAYER 8 Global Moderator

    No he clearly stated

    "If you do not want NAT, then disable NAT and not the packet filter."

    Which I agreed with.. If you don't turn off the packet filter than you need rules.. I just said it in slightly different way with emphasis that you would need any any rules if the filter is on if you want it to act like a router.



  • You can have no WAN (or any other interface) rules when you turn the packet filter off.

    This threw me off.  I know there are a lot of non-native English speakers here and sometimes the Euro flair can be read differently.  I read it to mean that you MUST remove the WAN rules if you are to disable the packet filter.



  • So from what I've learned

    Enable Firewall

    Disable Outbound NAT

    Add Any Any Rules to each interface on the firewall e.g.

    IPv4*  *      *      *      *      *    none

    This should do all my routing to and from the smoothwall box


  • LAYER 8 Netgate

    This should do all my routing to and from the smoothwall box

    Whatever a "smoothwall box" is it will have to have routes for all the networks behind pfSense with the pfSense IP address as the routes' next hop.



  • The Smoothwall box is a transparent proxy / UTM, I work in a school and we need filtering enabled for students. Currently we rely on the Smoothwall box for routing between subnets (for wifi over vlans) for MDns, problem is we rely too much on it e.g

    LAN  –-> SMOOTHWALL ---> WAN

    We don't have any layer 3 switching as the budget is restrictive, only layer 2 that serves the VLANS so swapping out the SMOOTHWALL utm for another vendor is difficult as most other vendors don't have routing / radius / dhcp etc. built in

    So I'm trying to utilise old hardware so the topology looks like this :-

    PFSense Router -----> PROXY -----> PFSense firewall, so I can slot any vendors filtering hardware in place of the proxy

    The only problem I've faced is getting Smoothwall talking back to active directory for authentication purposes, if I know the PFSense configuration is correct then I know any problems lies within Smoothwall.



  • I made a new box and kept it as simple as possible

    Enable Firewall

    Disable Outbound NAT

    Add Any Any Rules to each interface on the firewall e.g.

    IPv4*  *      *      *      *      *    none

    But it's still not working, the traceroute from the wan to the LAN seems to bounce around the WAN ip and the gateway

    Here's an album of images
    http://imgur.com/a/1X55p


  • LAYER 8 Global Moderator

    dude smoothwall needs to know how to get to the networks behind pfsense - it has to have a route that talks to pfsense want to get to segments behind pfsense.

    This is normally done with a transit network so you don't run into asymmetrical routing.



  • Cheers, So is this a Smoothwall thing or a pfsense thing I need to look at ?


  • LAYER 8 Global Moderator

    pfsense knows by default how to route to any network connected to it that it has an interface in.  Your smoothwall doesn't know about the networks behind pfsense unless you tell it, or you are running some routing protocol between smoothwall and pfsense so they can share their routes.

    And if boxes behind pfsense are going to talk to devices on the wan side directly and not just the gateway for stuff outside smoothwall you can run into a asymmetrical route issue where pfsense oh I am directly connected to that network wills end the traffic direct to that IP..  That devices says hmm where is that IP, its not on my network - I need to send it to my gateway your smoothwall.  So that is asymmetrical and you have issues with stateful firewalls in that scenario.



  • So what's the fix ? I can add another NIC in the smoothwall box and bridge the interfaces but it kind've defeats what I'm trying to achieve - I'm trying to move away from bridging on smoothwall


  • LAYER 8 Global Moderator

    The fix is to have the correct routing..  Why would you need another nic you could just vlan.  And who said anything about bridging?

    If you want to use another nic for your transit network - sure, or could just be a vlan.  Will ips behind pfsense be accessing ips on the wan of pfsense, or will clients just be going to the smoothwall?  But smoothwall needs to know how to get back to networks behind pfsense.

    example - see attached.

    So you have devices on 192.168.1.0/24 that want to go to the internet, lets say domainx.com at 1.2.3.4, he sends that traffic to pfsense, pfsense I don't any networks that holds that IP.. So send to my gateway (smoothwall at 192.168.0.1)  Traffic comes back to smoothwall.. Smooth says I need to send this to 192.168.1.x – he needs to know that he needs to send that to 192.168.0.2

    So on your smoothwall you need routes
    192.168.1.0/24 192.168.0.2
    192.168.2.0/24 192.168.0.2

    This works fine as long as you don't have box on 192.168.1.x talking to 192.168.0.x  This is where you run into possible asymmetrical route problem.

    lets say 192.168.1.14 wants to talk to 192.168.0.28, he again sends it to pfsense on his segment.  Pfsense says oh I have that 192.168.0.0/24 network directly attached so will just put that traffic on the wire to 192.168.0.28..  192.168.0.28 says oh 192.168.1.14 wants to talk to me - that is not on my network so send it to smoothwall.  Smooth once you put in the routes says oh send that to 192.168.0.2, if pfsense is firewalling this would be out of state traffic depending..  Either way it is an asymmetrical and normally something you want to avoid.

    How you fix asymmetrical is with a transit network - see  2nd attachment, on the right side.

    One thing for sure is you need smoothwall having routes to those networks behind pfsense - unless pfsense was natting this traffic.  If pfsense was natting then you would only see traffic from pfsense interface in that 192.168.0.0/24 network.

    You will also need to make sure any rules be it firewall or proxy on your smoothwall allow for traffic from these 2 new networks 192.168.1.0/24 and 192.168.2.0/24






  • Thank you :) Things are clearer now - what I've done in the end and got it working was to add another nic to smoothwall gave it an IP on the lan range and pointed dynamic DNS to the DC - I now have authentication working

    Thanks again for your patience - can be quite frustrating to fix these things at times


  • LAYER 8 Global Moderator

    " add another nic to smoothwall gave it an IP on the lan range"

    You did what?  You connected your smooth wall directly to the lan of pfsense?



  • No,

    Something like this, the Smoothwall is only connected to the DC with DNS (the extra NIC is on the same range), no routing or zone bridging which means now I can attach any other vendors filtering solution much more easily.


  • LAYER 8 Global Moderator

    So your DC has 2 interfaces as well and you have a wired connecting your smoothwall and your DC, and your dc is also connect to your pfsense lan?

    "only connected to the DC with DNS"

    Why would you need an extra nic for joining smoothwall to your AD or pointing to it for dns resolution?



  • No, the NIC is joined to the domain via the domain switches, DNS is resolved on the smoothwall box using dynamic DNS,
    This is the only way I've got Smoothwall to talk to the DC


  • LAYER 8 Global Moderator

    dynamic dns does not resolve anything - dynamic dns registers a name in a domain.

    You clearly got a mess there.. why do you have smoothwall between 2 pfsense setups.. Is smoothwall doing nat, and pfsense in front of it also doing nat?

    No idea what a domain switch is??  Is that another segment?  Why do you have so many devices that can be firewalls?  If you like smoothwall why not just use it? And add the interfaces you require to have a leg in each segment or vlan it out, etc.

    Can you draw out your network with networks and your layer 2 switches.. I am taking it you have more than 1 switch.. A switch your calling a domain switch, and then another switch you have connected to pfsense lan and opt1 – is this the same switch, do you have it doing vlans?  You should run more than 1 network over the same physical wire.



  • Okay,

    What we have now is a network with layer 2 switches with vlans for wifi with a gateway of 192.168.5.253 which is the IP of the smoothwall UTMb
    The smoothwall UTM does intervlan routing with zone bridging as well as radius and DHCP. We also use a raspberry pi to route MDns traffic

    We plan on swapping out the Smoothwall for maybe a Lightspeed rocket or a IBoss filtering system (these are both inline) neither of these boxes can do routing nor radius etc.

    Options are to replace Smoothwall with a layer 3 switch which goes to the lightspeed / Iboss then to a pfsense firewall. However we cannot afford a layer 3 switch so I came up with the genius idea of using a pfsense as a router - maybe this was a bad idea - might just be better off getting a HP 1920-8G

    I'm having to try all this side by side on a live system as we have no hardware for a lab - making it harder than it should be


  • LAYER 8 Global Moderator

    layer 3 switches don't have to be 1000's of dollars.  But you still would have the same routing problem..  Upstream routers always have to know how to get to downstream networks..  You can manually do it or run a routing protocol.

    How many ports do you need on this L3 switch?  You can get a cisco sg300 10 port for example that will do L3 for less then 200$, what hardware you running pfsense on currently?

    If your pfsense was to replace your smoothwall, why is the smoothwall still in the network?



  • I'm currently testing with an old desktop just to see if I can achieve this for as little as possible before investing

    PFSense isn't replacing the smoothwall, I'm replacing the smoothwall with another filtering solution (think of smoothwall as dansguardian / squid which is what it basically is) - the other solutions are not UTM's so I need to sort out a firewall (again as cheap as I can)

    routing –--> smoothwall -----> firewall

    I may have to throw some cash at one of those ciscos (or the HP) instead


  • LAYER 8 Netgate

    I would probably:

    Internet <–-> pfSense <---> Content filter <---> L3 Switch <---> Local segments

    Unless you need significant filtering between local segments - in which case the L3 switch would be another pfSense.



  • Here's an image from the lightspeed manual, which is what I'm trying to achieve

    I intend to use a pfsense box as the core switch, the management nic there is basically the extra nic I put in the smoothwall to enable management and AD authentication


  • LAYER 8 Global Moderator

    pfsense would not be my choice for a "core" switch..  Its a router, you will see much better speeds using a L3 switch..  Do you need to control access between these segments with firewall rules?  If not then L3 switch is the way to go..



  • I know, I'm going to request one of those cisco switches you recommended, although with using PFSense I can install avahi and send MDns traffic around the lan and vlans and also setup a WIFI portal with radius so PFSense has some benefits over a layer 3

    In the meanwhile, I seem to have got everything working okay authentication is working and passing traffic via both non transparent and transparent proxy through the pfsense. It's been a learning curve but I've learnt quite a bit!


  • LAYER 8 Global Moderator

    The sg300 line can do multicast routing, which would take care of your mdns stuff.

    As to a wifi portal – yeah you would normally do that on your actual wifi controller..  What are you using for wifi?  Pfsense makes a horrific access point.. Why would you not just get a 70$ ap from unifi run their free controller on a vm and there you go all the wifi portal shit you could want, vouchers, pay with cc, time limits, etc. etc..

    While I am big fan of getting by with what you have on a small budget when need too, and you can do some amazing things with really no money, etc.  In a work setup - its much better to spend a few dollars..  For example the unifi AP are 70$ or the pro versions are 200$  This is pretty small budget items for a company.. Shit I have the AC 300$ model in my house ;) I would think a company could afford 70 for stable wifi.



  • We are running unifi, I've not played around with the portal too much but I need it to have stuff like import certs for HTTPS inspection policies on the portal screen.

    I still think you need to run avahi to route MDNS /bonjour , cisco have a document on it - I'm running AVAHI on a raspberry pi and its serving us well (inc. printer sharing via cups) so this can be moved to pfsense

    http://www.cisco.com/c/en/us/support/docs/wireless/aironet-1100-series-access-point/113443-cuwn-apple-bonjour-dg-00.html


  • LAYER 8 Global Moderator

    You can customize the unifi portal to your hearts content so putting a link to a CA cert should not be a problem.  Or just using a trusted signed cert should remove that problem all together.

    You are correct mdns can be a pita, think the ttl is 1, etc.  I solved it even easier way by just putting my printer on the wlan segment ;)  Before that I had done it with cups, where my cups server just had an interface in the wlan segment as well.  Then I didn't have to worry about running cups.


Log in to reply