Passing ISP IP through a pfSense FW to another firewall

[kschmidta]

I'd like to extend a group of public address from my ISP to a firewall located behind my pfSense firewall, see drawing attached. Can this be done? if so, how do I configure my pfSense firewall.


[viragomann]

The OPT interface must not be in the same subnet as the WAN. So your secand pfSense also must belong to another subnet.

[kschmidta]

Can you mark up my drawing as a sample of how it should be configured? Also note how I would configure the interfaces?


[viragomann]

Okay, I assume the numbers in the colored fields are vLANs. So this way it could work, you just need to bridge WAN and OPT1 and assign the WAN address to this bridge.
https://doc.pfsense.org/index.php/Interface_Bridges

[kschmidta]

I will check it out. Thanks for taking the time to help me out.

[Guest]

With the ISP router which is doing NAT (1) and the pfSense is doing also NAT (2) and on top the
other firewall is doing also NAT (3) you were creating a triple NAT situation and related to this this
your problems exists. You have two choices to get rid of this issue.

• Set the ISP router to the so called "bridge mode" that the router is only acting as a pure modem
  if this able to realize, it would be the fastest and most stable way. Or buy a plain and pure modem.
  Cons: no
  Pros: You have then only created a double NAT situation with which you can live.

• Or you should bridge the LAN port from the ISP router to the WAN port from the pfSense firewall
  as suggest from @viragomann, that pfSense is acting as a fully transparent firewall then.
  Cons: Port flapping, packet loss or packet drops
  Pros: fully transparent firewall which is invisible