NAT inbound issues (proxmox + pfSense)

drakero57

New Member
Jan 12, 2024
2
0
1
Hello everyone, I am really new to proxmox and have tried setting up NAT inbound rules to redirect incoming traffic to my pfSense firewall without much success.

In the context of a school project, I need to design a secure network for a shopping website: this means our server only has one NIC.

1705015719320.png

(don't mind vmbr4 - I just needed an IP on our range to expose our server on the network for testing purposes)

What I've managed to achieve so far:

-basic proxmox setup (on 100.66.52.22)

-install pfSense on a VM

-configure pfSense:
1705015997282.png
WAN is vmbr2 and LAN is vmbr1 : this is probably where i did something wrong, for some reasons i did not manage to make my pfsense reach the internet when WAN was set on vmbr0 and everytime I would make a change to the config proxmox's internet would be down for a minute

-create VLANs under pfSense for each dedicated use

-allow those VMs to reach each other and reach the internet thanks to NAT outbound rules:

1705016357040.png


The problem I now have is that no matter what i try to put in iptables, I cannot reach my pfSense from the outside (the idea is to NAT from proxmox to pfSense, and then from pfSense to the VMs in order to put rules there)

Here is what I tried:
1705017344613.png

I did systemctl restart networking after every change.

From my understanding, this should NAT requests going to 100.66.52.22:8080 (vmbr0) to 192.168.10.190:80 (vmbr2) which is the IP of my pfSense.
But when I type 100.66.52.22:8080 in my browser, nothing comes up.

Thank you in advance for taking the time to read this and eventually come up with a solution
 

Attachments

  • 1705016344430.png
    1705016344430.png
    27.6 KB · Views: 5
littlee up here, I managed to set the NAT as well as firewall rules. I can reach my server through http but not through https, anyone has an idea why? the server works in both http and https on the vlan.
 
Firstly, I would not use iptables and pfsense together, it's making more complication than you need IMO

Normally, pfsense has the public IP address and then you can setup NAT rules on that to direct incoming traffic as you desire. The complication here is that you only have one physical nic on the server - yes?

Is the network switch you're connecting to VLAN capable and do you have access to change the configuration?
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!