Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    One wan, multiple isolated lans, nat

    Firewalling
    3
    4
    538
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fourseasons last edited by

      Hello

      I recently received a SG4860 and studied the various howtos on this site to get a hang of the basic configuration. My plan is to configure the firewall as best I can and use the free included support hours to have a professional look over it before it goes into "production".

      I need three LAN networks:

      LAN - 192.168.0.1/24
      OPT1 - 192.168.5.1/24
      OPT2 - 192.168.10.1/24

      all of them with access to one WAN IP (using NAT)

      all of them should be isolated from eachother

      IPv6 is disabled.

      I'm trying to do this step by step and get the basics sorted first.
      is this firewall rule setup correct so far?

      1 Reply Last reply Reply Quote 0
      • T
        Trel last edited by

        Is it your intention that someone could manually set a route and access all LAN, OPT1 and OPT2 when connected to OpenVPN?
        (Other than that, I'm not seeing anything that would break the setup rule-wise)

        1 Reply Last reply Reply Quote 0
        • F
          fourseasons last edited by

          @Trel:

          Is it your intention that someone could manually set a route and access all LAN, OPT1 and OPT2 when connected to OpenVPN?
          (Other than that, I'm not seeing anything that would break the setup rule-wise)

          That's not necessarily the primary intention but yes, I'd like to be able to access all 3 networks via OpenVPN.

          I've since "cleaned up" the rules using an RFC1918 alias but it's good to have some confirmation that I'm headed in the right direction. I've also managed to set up 3 virtual (public) ips on the WAN and give each network it's own IP using outgoing manual NAT.

          Fortunately I have a lot of time to get things right before I have everything looked over by pfsense support (unless such usage of an incident is frowned upon?) and put the box "live".

          The free gold subscription that was included with the hardware helps a lot.

          1 Reply Last reply Reply Quote 0
          • Derelict
            Derelict LAYER 8 Netgate last edited by

            What about access from the various LANs to services running on the firewall like the webconfig?

            All LANs will be able to access that.

            Chattanooga, Tennessee, USA
            The pfSense Book is free of charge!
            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • First post
              Last post