Jump to content



Photo

PFSense, Static IPs etc

pfsense

  • Please log in to reply
37 replies to this topic

#1 Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 01 June 2013 - 23:44

Hi -

Need some help here, with some simple instructions.

I want to use a PFSense installation to act as the edge device in my esx between my main home network and a bunch of VMs.

My home network has a router which has an IP Address of 192.168.0.1, and gives out address 192.168.0.2-199 over DHCP and 200-255 are for static assignment.

I have set up my PFSense box so that it plugs into my router and I want it to have two interfaces (which it has). One of these interfaces is a WAN interface (the one plugged into router) which I want to have an IP address of 192.168.0.210. For the LAN interface of the PFSense box, it has the IP address of 192.168.1.1 and gives out 192.168.1.2-255 over DHCP for machines plugged in on that side.

Can someone tell me what I need to configure in my PFSense box so that:
1) I can get to the PFSense web configurator from the 192.168.0.x network, for convenience.
2) The PFSense box has a static IP address of 192.168.0.210 on its WAN interface.
3) All the boxes in the 192.168.1.x network (i.e. PFSense LAN) are able to get to the internet.

Chances are I have missed a lot of detail. My understanding of networking is elementary at best, so if your responses are met with some dumb questions, please humour me until I try to comprehend the advice you give me.

Many thanks as always.


#2 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 02 June 2013 - 03:54

1)Well you need to allow access to the webgui from the WAN, normally that is not a good idea because the wan is normally the internet/hostile network. You are normally on the lan, private/safe side.

2) Set a static on it, via interfaces - change from dhcp to static.. Pretty straight forward. Do you need a picture?

3) Yeah - but they are double natting, unless you turn off nat on pfsense and just turn it into a firewall/router - but now its going to be a bit more difficult for you current router lan to know how to get to the pfsense lan.

For why do you want to do this? Normally the lan is secure, why should you need to isolate your vms from your lan?

If you did want to do that - then just make pfsense your actual internet router and have multiple segments where you have lan and vm segment, dmz, wireless -- you can have as many segments as you want - then pfsense can firewall between them all while doing nat to the public internet.. And you still accessing the webgui from a lan side interface.



#3 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 02 June 2013 - 10:26

1)Well you need to allow access to the webgui from the WAN, normally that is not a good idea because the wan is normally the internet/hostile network. You are normally on the lan, private/safe side.

2) Set a static on it, via interfaces - change from dhcp to static.. Pretty straight forward. Do you need a picture?

3) Yeah - but they are double natting, unless you turn off nat on pfsense and just turn it into a firewall/router - but now its going to be a bit more difficult for you current router lan to know how to get to the pfsense lan.

For why do you want to do this? Normally the lan is secure, why should you need to isolate your vms from your lan?

If you did want to do that - then just make pfsense your actual internet router and have multiple segments where you have lan and vm segment, dmz, wireless -- you can have as many segments as you want - then pfsense can firewall between them all while doing nat to the public internet.. And you still accessing the webgui from a lan side interface.


pfsense will become my internet router eventually - just don't feel I know networking well enough yet for this to happen right now.

Can you tell me the exact settings I need to change for the above and more importantly why?

#4 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 02 June 2013 - 10:49

Do you know networking enough to have a router that your using now to give you internet? Pfsense is a router/firewall - not really any different than the one your using now.. Just more features available is all, you don;'t have to use the features if you don't want too.

Vs setting up some nonsense where you use pfsense from the wrong side, ie the wan.. I would use it as your router now, I use it via a vm on esxi as my wan router.. I can show you exactly how to set that up..

Or we can go this vm route if you want - but its kind of a pointless step if you ask me.

#5 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 02 June 2013 - 19:55

Or we can go this vm route if you want - but its kind of a pointless step if you ask me.


I didn't ask your opinion as to whether it was a good idea - just want your help in achieving it.
Now if you want to help in answering the question I actually asked, I would be most grateful

#6 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 03 June 2013 - 00:14

I already answered your questions... You need pictures?

1) Open the port your web ui is running on - mine is just http, yours might be https??

http://doc.pfsense.o...I_from_the_WAN?
They state you should change to https Because wan is normally hostile not your own lan.

wanrule.png

2) Pick static vs dhcp
http://doc.pfsense.o...tings#Static_IP

wan.png

3) Yes devices/vms on pfsense have access to the wan - pfsense out of the box will nat them. If pfsense wan has internet access.. Then lan devices will have internet access.

#7 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 04 June 2013 - 21:22

Your instructions for setting a static IP address now mean that my VMs can't see the internet. Incomplete instructions I imagine.

I set:
Address type: Static
IP Address: 192.168.0.210
Gateway: none --> as you didn't tell me to set one.
Also unchecked Blocked private networks as my WAN also lies in a private address space.

Unlike your screenshot, I don't have separate IPv4 and IPv6 configuration.


Any idea what settings may also need to be filled in and where?

Attached Images

  • Capture-20130604.PNG


#8 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 05 June 2013 - 17:02

"I set:
Address type: Static
IP Address: 192.168.0.210
Gateway: none --> as you didn't tell me to set one."

Really you don't understand that you need a gateway and dns?? Do you really need me to show a picture of what your SETTINGS should be for your static address? Look at one of your clients that is dhcp.. use those settings for your gateway IP and dns.

Did you read the link I pointed too?

"For Static IP interfaces, you manually enter the IP address and CIDR mask.
If this will be a WAN-type interface, you can either select a gateway from the list or click "add a new one" to create a new gateway.
If you are creating a gateway, you can check the box to select it as a default gateway, enter a name, gateway IP address, and a description."

Yes I have ipv6 because I run 2.1 dev -- what does that have to do with setting your ipv4 address?

As to setting your DNS, your going to have to go to your system: general setup area and set one or more since your not getting that info from dhcp any more.

Since you stated your router is 192.168.0.1, that would be your gateway and dns I would assume.

#9 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 05 June 2013 - 22:32

I did ask you for exact instructions, not sure how much clearer I could have been :-)

I set those settings and my VMs still can't see the internet.

If I go in to Chromium and go to www.google.co.uk I get ERR_NAME_NOT_RESOLVED and if I go to 173.194.66.94 I get ERR_ADDRESS_UNREACHABLE.

Any suggestions?

#10 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 06 June 2013 - 15:52

"with some simple instructions."

I gave you "simple" instructions - you did not ask for EXACT PICTURES of what you need to do.

I guess I wrongly assumed you had a "basic" understanding of how to setup static IPs - since you have reserved space on your lan for statics. "200-255 are for static assignment." Guess my bad that since you put in 255 as a usable address - which would be the broadcast on a /24 and not a viable static address ;)

So since you mention chrome I guess your doing that on client VM? On the pfsense lan..

So what are the settings you have in place.

So you have this

internet (router) 192.168.0.1 --- your current lan ---- 192.168.0.210 (wan - pfsense - lan) 192.168.1.1 ---- 192.168.1.2 vm client

So can you post a picture of your esxi vswitch setup? Your pfsense interfaces should be connected to the vswitch that is connected to your current lan via the esxi host physical interface connected to your current lan.

Then I would assume you have another vswitch that your pfsense lan inteface is connected to and your other vms have their interfaces connected too - lets call this the pfsenseLAN vswitch.

So in this setup pfsense wan would be 192.168.0.210/24 gateway 192.168.0.1, dns should most likely be your router as well 192.168.0.1

You should be able to then on pfsense be able to use diagnostic menu dns lookup.. And resolve stuff via the pfsense box. Ping your router IP 192.168.0.1 etc..

Now your vms that are the 192.168.1.0/24 network on the pfsense lan side should use 192.168.1.1 as their gateway and 192.168.1.1 as their dns - this should be gotten from dhcp from pfsense.

They will then be able to ping 192.168.1.1, they should be able to ask 192.168.1.1 for dns, which in turn asks 192.168.0.1 for dns and then your router would ask your isp or whatever dns you have setup on that to resolve say www.google.com

Your then good to go.

I don't have time currently but I could duplicate your setup on my esxi host and show you pictures of how to setup.. And use the exact version of pfsense that your using.. Are you using 2.0.2, 2.0.3 i386 or amd64? What driver are you using for the pfsense interfaces? e1000 or vmxnet2 or 3?

to use vmxnet you will most likely need to have vmtools installed on pfsense. Your first step is going to get pfsense wan to connect to your current lan. You should be able to verify this via console on esxi. Once you have that working - then you can setup a vm on the pfsense lan side and use that to connect to the web ui. From there you can continue the setup and then allow web gui access from the pfsense wan side - your current lan network 192.168.0.0/24

Let me know if any of the above does not make sense and we can move forward with either better instructions (pictures) or troubleshoot what is not working.

Any details/pictures you can post would be helpful.. Can you show your esxi setup for your pfsense and its vswitches for example. Output from your current lan dhcp client will help us verify the gateway and dns settings that should be used for static. And if you could show the dhcp output from a vm connected to your pfsense lan would also be helpful.

Configuration of pfsense in this manner is a bit more complicated.. Since out of the box you can not access the web gui, you have to be coming from the lan side. So since yours is a vm - we need to be coming from a vm connected to the pfsense lan side to even allow access from wan, etc.

#11 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 06 June 2013 - 22:33

The Chromium browser I am running is in an Ubuntu VM on the LAN side.

The name of my pfSense machine is obrien, riker is the name of my Ubuntu VM - I've attached the config of the networks in ESX.
All vNICs on all VMs are E1000.

The network settings on the Ubuntu VM and my Windows 8 physical machine (on the LAN which is the WAN side of pfSense) are also attached.

The config I have:
internet (router) 192.168.0.1 --- your current lan ---- 192.168.0.210 (wan - pfsense - lan) 192.168.1.1 ---- 192.168.1.103 vm client

I can't ping my router (192.168.0.1) from my pfSense VM - I get the attached.
I can ping my router (192.168.0.1) from my Windows 8 machine just fine
I can't ping the pfSense box (192.168.0.210) from my Windows 8 machine, I get request timed out, 100% packet loss.

I am using pfSense 2.0.3 i386.

Not sure if there is anything else I can add. Don't understand why this works perfectly with DHCP turned on for WAN interface of the pfSense VM but not when the same machine is statically addressed.

Edit: For completeness, added images of my pfSense Interface, DNS and Gateway configuration.

Attached Images

  • ESXNetworkConfig.PNG
  • pfSensePing.PNG
  • UbuntuNetworkConfig.PNG
  • Win8IPConfig.png
  • Win8PingpfSense.png
  • pfSenseDNS.PNG
  • pfSenseGateway.PNG
  • pfSenseInterface.PNG


#12 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 07 June 2013 - 03:31

hmmm - while I can understand why you can not ping pfsense wan IP from your current lan. Until you allow that on firewall rule that would be blocked. I don't understand why you can not ping your router ip 192.168.0.1 from pfsense diag tools? Or cmd line of pfsense via console access on esxi?

Can you post your interface status from pfsense for wan

Problem is -- I am headed out of town early tmrw morning.. Tell you what, let me grab 2.0.3 and add it real quick to my esxi host.. Give me a few minutes..

edit.. Ok downloaded pfSense-LiveCD-2.0.3-RELEASE-i386-20130412-1022.iso

Created a Vm.. put one interface in my lan vswitch, other in dmz vswitch - set its mac so I knew which one it was. Changed it too version 9 vm. Booted the CD.. clicked easy setup.

So it defaulted to dhcp on wan and got an IP in my lan
firstboot.png

So then from that esxi console I changed its wan IP to be on static on my network 192.168.1.150, changed the lan network to 192.168.0.0/24 - this is via option 2 in that above screen

Now I did not set a gateway yet for wan, but it lets me ping IPs on my lan network

changewanip.png

So now let me fire up vm on that dmz segment that gets IP via dhcp from pfsense dhcp. - brb

edit2: Ok its been like 5 minutes maybe..

So put a vm on the lan segment of pfsense vswitch so I could connect to it and finish the wizard

So its gets an IP from pfsense dhcp - but it can't go anywhere yet

vmboot.png

So I fire up a browser and connect to pfsense - mine is 192.168.0.1 vs your 192.168.1.1 -- my normal lan is 192.168.1 vs 192.168.0 like you have so I just reversed them. And my current pfsense router is 192.168.1.253 vs your 192.168.0.1

So running through the wizard it asks me for dns for pfsense -- which is why I put in my current router (pfsense in my case) 192.168.1.253

wizard1.png

It then asks me for gateway

wizard2.png

Remember I had changed its IP from the esxi console to be static and on my network already -- see the early screeny

Now the wizard does some stuff

wizard3.png

It will finish after a few seconds.. I then went to diag ping area and can ping google
wizard4.png

And as you can see my vm can now ping google (internet access) connect to the lan side of my new vm pfsense behind another VM pfsense in my case vs your actual router can ping as well

wizard5.png

So not sure what your doing wrong - are you not completing the wizard? So then I go in and change the firewall rules to allow access from my current lan (pfsense wan for web gui access) via my vm on the lan side of pfsense
wanguiaccess.png

And there you go I have wan gui access

acceswsviawan.png

So that was my 10 minute tutorial - I have to hit the road for trip at 5am.. I will be back on Monday - more than happy to help you figure out where your problem is. If need be you can let me remote in and we will get you fixed up! Hope this helps

From what you posted it looks correct from my quick look - but if your pfsense wan interface can not ping stuff on your current lan - then no its never going to work.. You need to be able to ping your router 192.168.0.1 from pfsense on 192.168.0.210 - if not, then nope never going to work.. So need to figure out what is not right.

edit3:

So you can see my vswitches.. Here is where I brought up my pfsense 203 (pf203)

vswitches.png

And the w7-new is the box I used to connect to pfsense I was setting up. The pfsense-vm which is my actual gateway router does have an interface in that vswitch - but its on a different segment

pfsense-vm.png

#13 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 08 June 2013 - 11:40

I was following the same process except I wasn't choosing Option 2 from the console menu to set interface IPs.

I decided to choose Option 4 from the console menu and start again, following the very same process that you followed, and now everything is working fine.
I still don't understand why it wasn't working in the first place.

Thank you for all of your help in getting this working.

#14 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 08 June 2013 - 13:31

So where did you set ips? If you had access to GUI you can set ips there? Glad you got it sorted. Have fun - sure you will be ready to use pfsense as gateway for your whole network soon

#15 OP Fahim S.

Fahim S.

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 15-April 02
  • OS: Windows 8 - OG
  • Phone: Google Nexus 4 16GB by LG

Posted 09 June 2013 - 18:09

Was using the WebGUI wizard or the WebGUI screens - clearly this method works better.
It's a very cool platform but I need to spend the best part of £250 to use it as the gateway for the whole network - which I plan to do over the next 2 months.