PFSense, Static IPs etc

[+Fahim S. MVC]

Hi -

Need some help here, with some simple instructions.

I want to use a PFSense installation to act as the edge device in my esx between my main home network and a bunch of VMs.

My home network has a router which has an IP Address of 192.168.0.1, and gives out address 192.168.0.2-199 over DHCP and 200-255 are for static assignment.

I have set up my PFSense box so that it plugs into my router and I want it to have two interfaces (which it has). One of these interfaces is a WAN interface (the one plugged into router) which I want to have an IP address of 192.168.0.210. For the LAN interface of the PFSense box, it has the IP address of 192.168.1.1 and gives out 192.168.1.2-255 over DHCP for machines plugged in on that side.

Can someone tell me what I need to configure in my PFSense box so that:

1) I can get to the PFSense web configurator from the 192.168.0.x network, for convenience.

2) The PFSense box has a static IP address of 192.168.0.210 on its WAN interface.

3) All the boxes in the 192.168.1.x network (i.e. PFSense LAN) are able to get to the internet.

Chances are I have missed a lot of detail. My understanding of networking is elementary at best, so if your responses are met with some dumb questions, please humour me until I try to comprehend the advice you give me.

Many thanks as always.

[+BudMan MVC]

1)Well you need to allow access to the webgui from the WAN, normally that is not a good idea because the wan is normally the internet/hostile network. You are normally on the lan, private/safe side.

2) Set a static on it, via interfaces - change from dhcp to static.. Pretty straight forward. Do you need a picture?

3) Yeah - but they are double natting, unless you turn off nat on pfsense and just turn it into a firewall/router - but now its going to be a bit more difficult for you current router lan to know how to get to the pfsense lan.

For why do you want to do this? Normally the lan is secure, why should you need to isolate your vms from your lan?

If you did want to do that - then just make pfsense your actual internet router and have multiple segments where you have lan and vm segment, dmz, wireless -- you can have as many segments as you want - then pfsense can firewall between them all while doing nat to the public internet.. And you still accessing the webgui from a lan side interface.

[+Fahim S. MVC]

1)Well you need to allow access to the webgui from the WAN, normally that is not a good idea because the wan is normally the internet/hostile network. You are normally on the lan, private/safe side.

2) Set a static on it, via interfaces - change from dhcp to static.. Pretty straight forward. Do you need a picture?

3) Yeah - but they are double natting, unless you turn off nat on pfsense and just turn it into a firewall/router - but now its going to be a bit more difficult for you current router lan to know how to get to the pfsense lan.

For why do you want to do this? Normally the lan is secure, why should you need to isolate your vms from your lan?

If you did want to do that - then just make pfsense your actual internet router and have multiple segments where you have lan and vm segment, dmz, wireless -- you can have as many segments as you want - then pfsense can firewall between them all while doing nat to the public internet.. And you still accessing the webgui from a lan side interface.

pfsense will become my internet router eventually - just don't feel I know networking well enough yet for this to happen right now.

Can you tell me the exact settings I need to change for the above and more importantly why?

[+BudMan MVC]

Do you know networking enough to have a router that your using now to give you internet? Pfsense is a router/firewall - not really any different than the one your using now.. Just more features available is all, you don;'t have to use the features if you don't want too.

Vs setting up some nonsense where you use pfsense from the wrong side, ie the wan.. I would use it as your router now, I use it via a vm on esxi as my wan router.. I can show you exactly how to set that up..

Or we can go this vm route if you want - but its kind of a pointless step if you ask me.

[+Fahim S. MVC]

Or we can go this vm route if you want - but its kind of a pointless step if you ask me.

I didn't ask your opinion as to whether it was a good idea - just want your help in achieving it.

Now if you want to help in answering the question I actually asked, I would be most grateful

[+BudMan MVC]

I already answered your questions... You need pictures?

1) Open the port your web ui is running on - mine is just http, yours might be https??

http://doc.pfsense.org/index.php/How_can_I_access_the_webGUI_from_the_WAN%3F

They state you should change to https Because wan is normally hostile not your own lan.

2) Pick static vs dhcp

http://doc.pfsense.org/index.php/Interface_Settings#Static_IP

3) Yes devices/vms on pfsense have access to the wan - pfsense out of the box will nat them. If pfsense wan has internet access.. Then lan devices will have internet access.

[+Fahim S. MVC]

Your instructions for setting a static IP address now mean that my VMs can't see the internet. Incomplete instructions I imagine.

I set:

Address type: Static

IP Address: 192.168.0.210

Gateway: none --> as you didn't tell me to set one.

Also unchecked Blocked private networks as my WAN also lies in a private address space.

Unlike your screenshot, I don't have separate IPv4 and IPv6 configuration.

Any idea what settings may also need to be filled in and where?

[+BudMan MVC]

"I set:

Address type: Static

IP Address: 192.168.0.210

Gateway: none --> as you didn't tell me to set one."

Really you don't understand that you need a gateway and dns?? Do you really need me to show a picture of what your SETTINGS should be for your static address? Look at one of your clients that is dhcp.. use those settings for your gateway IP and dns.

Did you read the link I pointed too?

"For Static IP interfaces, you manually enter the IP address and CIDR mask.

If this will be a WAN-type interface, you can either select a gateway from the list or click "add a new one" to create a new gateway.

If you are creating a gateway, you can check the box to select it as a default gateway, enter a name, gateway IP address, and a description."

Yes I have ipv6 because I run 2.1 dev -- what does that have to do with setting your ipv4 address?

As to setting your DNS, your going to have to go to your system: general setup area and set one or more since your not getting that info from dhcp any more.

Since you stated your router is 192.168.0.1, that would be your gateway and dns I would assume.

[+Fahim S. MVC]

I did ask you for exact instructions, not sure how much clearer I could have been :-)

I set those settings and my VMs still can't see the internet.

If I go in to Chromium and go to www.google.co.uk I get ERR_NAME_NOT_RESOLVED and if I go to 173.194.66.94 I get ERR_ADDRESS_UNREACHABLE.

Any suggestions?

[+BudMan MVC]

"with some simple instructions."

I gave you "simple" instructions - you did not ask for EXACT PICTURES of what you need to do.

I guess I wrongly assumed you had a "basic" understanding of how to setup static IPs - since you have reserved space on your lan for statics. "200-255 are for static assignment." Guess my bad that since you put in 255 as a usable address - which would be the broadcast on a /24 and not a viable static address ;)

So since you mention chrome I guess your doing that on client VM? On the pfsense lan..

So what are the settings you have in place.

So you have this

internet (router) 192.168.0.1 --- your current lan ---- 192.168.0.210 (wan - pfsense - lan) 192.168.1.1 ---- 192.168.1.2 vm client

So can you post a picture of your esxi vswitch setup? Your pfsense interfaces should be connected to the vswitch that is connected to your current lan via the esxi host physical interface connected to your current lan.

Then I would assume you have another vswitch that your pfsense lan inteface is connected to and your other vms have their interfaces connected too - lets call this the pfsenseLAN vswitch.

So in this setup pfsense wan would be 192.168.0.210/24 gateway 192.168.0.1, dns should most likely be your router as well 192.168.0.1

You should be able to then on pfsense be able to use diagnostic menu dns lookup.. And resolve stuff via the pfsense box. Ping your router IP 192.168.0.1 etc..

Now your vms that are the 192.168.1.0/24 network on the pfsense lan side should use 192.168.1.1 as their gateway and 192.168.1.1 as their dns - this should be gotten from dhcp from pfsense.

They will then be able to ping 192.168.1.1, they should be able to ask 192.168.1.1 for dns, which in turn asks 192.168.0.1 for dns and then your router would ask your isp or whatever dns you have setup on that to resolve say www.google.com

Your then good to go.

I don't have time currently but I could duplicate your setup on my esxi host and show you pictures of how to setup.. And use the exact version of pfsense that your using.. Are you using 2.0.2, 2.0.3 i386 or amd64? What driver are you using for the pfsense interfaces? e1000 or vmxnet2 or 3?

to use vmxnet you will most likely need to have vmtools installed on pfsense. Your first step is going to get pfsense wan to connect to your current lan. You should be able to verify this via console on esxi. Once you have that working - then you can setup a vm on the pfsense lan side and use that to connect to the web ui. From there you can continue the setup and then allow web gui access from the pfsense wan side - your current lan network 192.168.0.0/24

Let me know if any of the above does not make sense and we can move forward with either better instructions (pictures) or troubleshoot what is not working.

Any details/pictures you can post would be helpful.. Can you show your esxi setup for your pfsense and its vswitches for example. Output from your current lan dhcp client will help us verify the gateway and dns settings that should be used for static. And if you could show the dhcp output from a vm connected to your pfsense lan would also be helpful.

Configuration of pfsense in this manner is a bit more complicated.. Since out of the box you can not access the web gui, you have to be coming from the lan side. So since yours is a vm - we need to be coming from a vm connected to the pfsense lan side to even allow access from wan, etc.

[+Fahim S. MVC]

The Chromium browser I am running is in an Ubuntu VM on the LAN side.

The name of my pfSense machine is obrien, riker is the name of my Ubuntu VM - I've attached the config of the networks in ESX.

All vNICs on all VMs are E1000.

The network settings on the Ubuntu VM and my Windows 8 physical machine (on the LAN which is the WAN side of pfSense) are also attached.

The config I have:

internet (router) 192.168.0.1 --- your current lan ---- 192.168.0.210 (wan - pfsense - lan) 192.168.1.1 ---- 192.168.1.103 vm client

I can't ping my router (192.168.0.1) from my pfSense VM - I get the attached.

I can ping my router (192.168.0.1) from my Windows 8 machine just fine

I can't ping the pfSense box (192.168.0.210) from my Windows 8 machine, I get request timed out, 100% packet loss.

I am using pfSense 2.0.3 i386.

Not sure if there is anything else I can add. Don't understand why this works perfectly with DHCP turned on for WAN interface of the pfSense VM but not when the same machine is statically addressed.

Edit: For completeness, added images of my pfSense Interface, DNS and Gateway configuration.

[+BudMan MVC]

hmmm - while I can understand why you can not ping pfsense wan IP from your current lan. Until you allow that on firewall rule that would be blocked. I don't understand why you can not ping your router ip 192.168.0.1 from pfsense diag tools? Or cmd line of pfsense via console access on esxi?

Can you post your interface status from pfsense for wan

Problem is -- I am headed out of town early tmrw morning.. Tell you what, let me grab 2.0.3 and add it real quick to my esxi host.. Give me a few minutes..

edit.. Ok downloaded pfSense-LiveCD-2.0.3-RELEASE-i386-20130412-1022.iso

Created a Vm.. put one interface in my lan vswitch, other in dmz vswitch - set its mac so I knew which one it was. Changed it too version 9 vm. Booted the CD.. clicked easy setup.

So it defaulted to dhcp on wan and got an IP in my lan

So then from that esxi console I changed its wan IP to be on static on my network 192.168.1.150, changed the lan network to 192.168.0.0/24 - this is via option 2 in that above screen

Now I did not set a gateway yet for wan, but it lets me ping IPs on my lan network

So now let me fire up vm on that dmz segment that gets IP via dhcp from pfsense dhcp. - brb

edit2: Ok its been like 5 minutes maybe..

So put a vm on the lan segment of pfsense vswitch so I could connect to it and finish the wizard

So its gets an IP from pfsense dhcp - but it can't go anywhere yet

So I fire up a browser and connect to pfsense - mine is 192.168.0.1 vs your 192.168.1.1 -- my normal lan is 192.168.1 vs 192.168.0 like you have so I just reversed them. And my current pfsense router is 192.168.1.253 vs your 192.168.0.1

So running through the wizard it asks me for dns for pfsense -- which is why I put in my current router (pfsense in my case) 192.168.1.253

It then asks me for gateway

Remember I had changed its IP from the esxi console to be static and on my network already -- see the early screeny

Now the wizard does some stuff

It will finish after a few seconds.. I then went to diag ping area and can ping google

And as you can see my vm can now ping google (internet access) connect to the lan side of my new vm pfsense behind another VM pfsense in my case vs your actual router can ping as well

So not sure what your doing wrong - are you not completing the wizard? So then I go in and change the firewall rules to allow access from my current lan (pfsense wan for web gui access) via my vm on the lan side of pfsense

And there you go I have wan gui access

So that was my 10 minute tutorial - I have to hit the road for trip at 5am.. I will be back on Monday - more than happy to help you figure out where your problem is. If need be you can let me remote in and we will get you fixed up! Hope this helps

From what you posted it looks correct from my quick look - but if your pfsense wan interface can not ping stuff on your current lan - then no its never going to work.. You need to be able to ping your router 192.168.0.1 from pfsense on 192.168.0.210 - if not, then nope never going to work.. So need to figure out what is not right.

edit3:

So you can see my vswitches.. Here is where I brought up my pfsense 203 (pf203)

And the w7-new is the box I used to connect to pfsense I was setting up. The pfsense-vm which is my actual gateway router does have an interface in that vswitch - but its on a different segment

[+Fahim S. MVC]

I was following the same process except I wasn't choosing Option 2 from the console menu to set interface IPs.

I decided to choose Option 4 from the console menu and start again, following the very same process that you followed, and now everything is working fine.

I still don't understand why it wasn't working in the first place.

Thank you for all of your help in getting this working.

[+BudMan MVC]

So where did you set ips? If you had access to GUI you can set ips there? Glad you got it sorted. Have fun - sure you will be ready to use pfsense as gateway for your whole network soon

[+Fahim S. MVC]

Was using the WebGUI wizard or the WebGUI screens - clearly this method works better.

It's a very cool platform but I need to spend the best part of ?250 to use it as the gateway for the whole network - which I plan to do over the next 2 months.

[chrisj1968]

After reading all this, man, what a headache. I did study MS's basic networking back in 2000 at the local military/civilian collage for UMUC.

what topography is your favorite btw? I think bus topography is pretty common among most normal users

(sorry, didn't mean to hijack the thread.) I hope you get it figured out Fahim, best wishes!

[+BudMan MVC]

Why would you need to 250 to make it the gateway for your network? What would you need to buy even - you already have 2 nics in it..

"After reading all this, man, what a headache." What?

Other than having to put up pictures for the OP.. This is literally like 5 minutes tops worth of setup.. I brought up the VM and created the little tutorial in that. If you were not worried about pictures and explaining it to someone take all of 2 minutes to setup.

"what topography is your favorite btw? - did you mean Topology? No "bus" is not common among normal users ;) A "star" would be the common setup where their home router is the center (switch) and their computer/devices all connect to the switch.

And if you would of read all of it - you would of seen he has it working..

[articuno1au]

After reading all this, man, what a headache. I did study MS's basic networking back in 2000 at the local military/civilian collage for UMUC.

what topography is your favorite btw? I think bus topography is pretty common among most normal users

(sorry, didn't mean to hijack the thread.) I hope you get it figured out Fahim, best wishes!

It's not really a headache. Most things are much easier to do than to look at :p

As budman noted, it's topology >.< Bus network topologies are pretty rare. Star network topologies are far more common as they are cheaper and more resilient.

There are some great learning resources online if you want to get up to speed again (honestly Google could teach you a lot here :))

Why would you need to 250 to make it the gateway for your network? What would you need to buy even - you already have 2 nics in it..

"After reading all this, man, what a headache." What?

Other than having to put up pictures for the OP.. This is literally like 5 minutes tops worth of setup.. I brought up the VM and created the little tutorial in that. If you were not worried about pictures and explaining it to someone take all of 2 minutes to setup.

"what topography is your favorite btw? - did you mean Topology? No "bus" is not common among normal users ;) A "star" would be the common setup where their home router is the center (switch) and their computer/devices all connect to the switch.

And if you would of read all of it - you would of seen he has it working..

Be nice >.>

I guess he wants a dedicated box instead of running it in a VM? I'd just run it as a VM tbh.

Lastly, I'd have told him to cram it earlier.. Kudos for sticking it out >.<

[+BudMan MVC]

Ah -- sure if he breaks it out on its own box, then sure it would cost some cash.. Maybe that is his plan?

But he could make it his router now for his whole network, not just his vms without having to buy anything. From what I can tell of his network.

The "I didn't ask your opinion" almost put me off - but It think about the next guy wanting to do this, etc. ;)

[The_Decryptor Veteran]

I went with the $100 router + OpenWRT route, only functional difference is that it's Linux instead of BSD.

Going back to the topology bit, hybrid star ftw

[+Fahim S. MVC]

It's going to cost money because the server lives (and must live) in a different room from where the fibre modem and current router lives so getting the PPPOE output from the fibre modem to the room where the server lives, then getting LAN traffic back to the original location and putting a 8-port switch and access point to where the current router lives.

Also want to upgrade the RAM in the server to make sure it has enough as it is going to be 'production'.

[The_Decryptor Veteran]

It shouldn't cost $250 for some Ethernet cables and a switch, I bought 30m of Cat6 for like $30.

It shouldn't need that much RAM either unless you're running other stuff on it. My router only has 128MB of RAM and like 80% of that is cached/free in normal operation.

[+Fahim S. MVC]

There are 5 other VMs running on, and the last time I checked it was struggling - so yes, it needs RAM.

Also if I wanted unsightly cable everywhere it wouldn't cost much, but unfortunately my wife has forbid that.

So I need some homeplugs (decided I'd reuse 2 that I already had, replacing them with higher spec ones, will replace a 3rd also with a higher spec one) - ?120, more memory - ?50, an AP (Cisco probably) - ?80,

[+Fahim S. MVC]

Very happy to report that today I went 'live' with pfSense being my main router for my network - after some time messing around with PPPoE settings, I finally got it to work!

 

I am currently using my old router as an Access Point but would like to replace this in the longer term with a proper Access Point.

 

It seems to be faster and is much more powerful than the router it replaces.  I would encourage anyone who is considering it to go for it.

 

And thanks to BudMan for all his advice on the topic.

[+BudMan MVC]

Good to hear - so using your old router is fine, there really is no difference between it and a device branded as a AP other than it has more features that your just not using.