[SOLVED] PFSense VM

[Thalhammer]

Hi,
I'm trying to install a pfsense as a gateway/router for my local network.
In theory, my plan is quite simple:
I have a Fritzbox used as a modem connected to my switch in VLAN.
My normal network is in another VLAN.
So I have setup two nics to pfsense on bridge vmbr0, one with no VLAN tag (home net), one with the modems tag.
The Internet seems to work fine, I can surf and setup Portforwards to hosts NOT on Proxmox and it works too.
However, if I try to setup a port forward to any of the other VM's I can't get a connection.
I changed the gateway on my other VM to the pfsense ip and I can connect to the internet.
However, if I try to connect trough the nat forward I can't get a connection.
Any Idea what might be wrong?

== EDIT ==
I replicated this setup in a virtual pve instance (in VMware player) and had the same problem.
Turns out that pfsense drops packets when using virtio with hardware checksum offload, but only if those packets never crossed a physical network (as was the case in all non-working cases) because the checksum is not calculated.
Disabling hardware checksumming/switching to Intel e1000 immediately solves the issue in my virtual pve however, I have to test on my real pve tomorrow.

In case someone has the same issue:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059
https://forum.pfsense.org/index.php?topic=88467.0

Took me some time searching in the wrong direction until I found this.

 

[fortechitsolutions]

Hi, I'm unclear, if you have still a problem; or if you resolved this ?
For what it is worth, I've done similar-ish thing in past, more or less thus,

-- assume we have at least 2 x physical interface on the proxmox host
-- configure 2 x vmbr; one bound to each physical interface
-- assume we cable wan facing to the eth1 interface and lan-facing to eth0
-- and thus vmbr1<>eth1<>WAN and vmbr0<>eth0<>LAN
-- then we build our "firewall-router VM" with 2 interfaces, one aimed at each vmbr0,vmbr1
--- and we configure in a very traditional way, wan interface and lan inteface in our firewall VM
--- and then .. can do standard sort of firewall deploy,config etc. assuming you give a valid IP/mask/gateway on WAN and suitably setup also on the lan interface.

Not sure if this approach is of any help or interest to you though.


Tim

 

[Thalhammer]

I got it to work now.
Well I had done exactly this (except that my links are bonded and I use VLans on top) and everything was fine except Port forwards.

But it seems that my Problem really was the linked bug, because the second I disabled hardware checksum offloading everything started to work just fine.

 

[felixb101]

Hi,
Disabling hardware checksumming in pFsense in Advance - Networking tab fixed it for me.
I've been searching this for hours!

Thanks