Firewall Ports and ESXi VMs

ben007

Hi There.

We have a leased a pfsense firewall that is connected to our dedicated ESXi 6.0 server.

We have one VM that runs cpanel and WHMCS.

We also eventually want to host some other VMs as a VPS.

My question is how do we setup the firewall so that we can have traffic to go to the cpanel VM ( i.e 80,443,25,993,143, ect ) and when we add another VM how would we route the same ports to a different VM?

Currently I have port forwarded port 80 and 443 and the ports for cpanel but I will run into trouble when i have another VM that wants to use the same ports.

Would VLANS be an option and if so how would this be setup?

Ultimately I would love to setup a standard VPS ruleset and just allocate that one when adding more VPS VMs but my main concern is cpanel and how it uses ports that a VPS will wwant to use also.

Thanks in advance

johnpoz

you can not forward the same port to different IPs at the same time unless you have more than 1 public IP

ben007

Hi John,

Thank you for your response.

I do have more than one ip and I am using one on the cpanel vm.

So what you are saying is I would need a public ip for every VPS vm i setup?

This being the case what would be the correct way to set this up in the firewall? I have a firewall box and not running pfsense running in a vm.

Would i setup vlans and 1:1 NAT or virtual IPs?

I have turned off the firewall in esxi as this is behind the firewall…is this a good idea for simplicity or should I keep it on and just open the required ports?

Thanks again

johnpoz

Not sure why would would do 1:1 - how many ports do you want to forward? if just a handful then forward is fine - if its ALL of them then 1:1 nat.

ben007

I just want to forward and handful that is required for VPS like 80,443 and mail ports

I am just lost on how to setup the second public IP address and allocated it in the Firewall so that traffic from that IP passes through the firewall to the correct internal IP.

How do i tell the firewall about the Internal IP. Is this what virtual IPs are for?

KOM

Is this what virtual IPs are for?

Yes. You tell pfSense to assume a public IP address and then you have a port-forward rule that forwards whatever ports you want to that Virtual IP, and firewall rule that allows the communication.

1. Create Virtual IP - IP Alias for your public IP on WAN interface
2. Create a port forward that maps the IP Alias to a service/port(s) on your LAN server
3. By default, an auto-rule should be created that allows the firewall to pass the traffic, but if it isn't there or you have it set to not generate them then you have to add it yourself.

ben007

Thanks for the info.

I will give it a go tonight and post the results