[SOLVED] PFSense VM

T

Thalhammer

Active Member
May 2, 2016
14
0
41
29
Hi,
I'm trying to install a pfsense as a gateway/router for my local network.
In theory, my plan is quite simple:
I have a Fritzbox used as a modem connected to my switch in VLAN.
My normal network is in another VLAN.
So I have setup two nics to pfsense on bridge vmbr0, one with no VLAN tag (home net), one with the modems tag.
The Internet seems to work fine, I can surf and setup Portforwards to hosts NOT on Proxmox and it works too.
However, if I try to setup a port forward to any of the other VM's I can't get a connection.
I changed the gateway on my other VM to the pfsense ip and I can connect to the internet.
However, if I try to connect trough the nat forward I can't get a connection.
Any Idea what might be wrong?

== EDIT ==
I replicated this setup in a virtual pve instance (in VMware player) and had the same problem.
Turns out that pfsense drops packets when using virtio with hardware checksum offload, but only if those packets never crossed a physical network (as was the case in all non-working cases) because the checksum is not calculated.
Disabling hardware checksumming/switching to Intel e1000 immediately solves the issue in my virtual pve however, I have to test on my real pve tomorrow.

In case someone has the same issue:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059
https://forum.pfsense.org/index.php?topic=88467.0

Took me some time searching in the wrong direction until I found this.
 
Last edited:
Hi, I'm unclear, if you have still a problem; or if you resolved this ?
For what it is worth, I've done similar-ish thing in past, more or less thus,

-- assume we have at least 2 x physical interface on the proxmox host
-- configure 2 x vmbr; one bound to each physical interface
-- assume we cable wan facing to the eth1 interface and lan-facing to eth0
-- and thus vmbr1<>eth1<>WAN and vmbr0<>eth0<>LAN
-- then we build our "firewall-router VM" with 2 interfaces, one aimed at each vmbr0,vmbr1
--- and we configure in a very traditional way, wan interface and lan inteface in our firewall VM
--- and then .. can do standard sort of firewall deploy,config etc. assuming you give a valid IP/mask/gateway on WAN and suitably setup also on the lan interface.

Not sure if this approach is of any help or interest to you though.


Tim
 
I got it to work now.
Well I had done exactly this (except that my links are bonded and I use VLans on top) and everything was fine except Port forwards.

But it seems that my Problem really was the linked bug, because the second I disabled hardware checksum offloading everything started to work just fine.
 
Hi,
Disabling hardware checksumming in pFsense in Advance - Networking tab fixed it for me.
I've been searching this for hours!

Thanks
 
This article saved me!
I found doing the above steps increased CPU dramatically so I switched away from FreeBSD based options for this function.


This bug is still an issue 8yrs later and with the latest PFSense 2.8.0-RELEASE.

For those playing along, the original FreeBSD bug OP linked is still open!


Thank you to OP in 2017, hope this helps others in the future also looking at similar configuration.
 
You must log in or register to reply here.
Top Bottom