Proxmox + PFSense routing?

[RobFantini]

Yes. I can ssh to pfsense from vlan10 ,
and from pfsense ssh to vlan 10 .

 

[RobFantini]

I can also ssh to other vlans from pf

 

[bobmc]

Does the pfsense appliance have a publicly routable IP on the WAN side? In that case, you should be able to create NAT rules in pfSense to reach those clients

 

[RobFantini]

here are some pics

 

[bobmc]

That looks as though you're on the right track, I assume you've copied this config from your original setup.

Does any incoming traffic work? is anything showing in the logs?

 

[RobFantini]

firewall logs show no activity. i have the test 3322 port forward to do logging.

So i think the issue is with routing at the switches.

the switch runs nvidia linux . it is a debian based system.

routing is done using frr [ i barely understand ] .
here is parts of /etc/frr/frr.conf

ip route 0.0.0.0/0 10.1.0.2 30

10.1.0.2 is hardware pfsense off of swp24

auto swp24
iface swp24
 bridge-pvid 2

and vlan2 from interfaces

auto vlan2
iface vlan2
    address 10.1.0.13/24
    address-virtual 00:00:5e:00:01:00 10.1.0.1/24
    vlan-id 2
    vlan-raw-device bridge
    mstpctl-bpduguard yes
    mstpctl-portadminedge yes

this is the bridge on witches

auto bridge
iface bridge
    bridge-ports swp22 swp23 swp24 peerlink bond1 bond2 bond3 bond4 bond5 bond6 bond7 bond8 bond17 bond18 bond19 bond21 bond25 bond26 bond27 bond28 bond29 bond30 bond31 bond32
    bridge-pvid 8
    bridge-vids 2-250
    bridge-vlan-aware yes
    mstpctl-treeprio 4096

so vlan2 and hardware pfsense work OK.

now config for virtualized pfsense on switch.

auto swp23
iface swp23
 bridge-pvid 250
 
 auto vlan250
iface vlan250
    address-virtual 00:00:5e:00:01:00 166.130.173.3/24
    vlan-id 250
    vlan-raw-device bridge

I think the issue is that a route to 166.130.173.1 has to be added. however i assumed frr somehow just auto does that by learning routes.

 

[bobmc]

It does look like a routing error

12 101 ms 121 ms 97 ms 12.83.170.29
13 94 ms 94 ms 94 ms 12.249.2.22
14 93 ms 97 ms 94 ms mobile-166-216-138-29.mycingular.net [166.216.138.29]
15 94 ms 94 ms 98 ms mobile-166-185-045-172.mycingular.net [166.185.45.172]
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.

there would seem to be no route from 166.185.45.172 - does that ring any bells?

 

[RobFantini]

yes noticed that. we will be trying a wired WAN instead of that backup wireless lan later in the week. we purchased another wired wan which is getting intalled tomorrow - so will use that.

 

[RobFantini]

the wan device works fine as WAN2 at hardware pfsense. NAT works.

at the pf vm , firewall log shows a green pass when i do this from off site :

ssh -p 3322  IP

however i do not get to the linux test system when i run the ssh test .

that test works when WAN2 is connected to hardware pf.

 

[bobmc]

does WAN2 work on the hardware pfsense if WAN1 is disconnected?

 

[RobFantini]

does WAN2 work on the hardware pfsense if WAN1 is disconnected?

NO !

thank you for suggesting that test.

our new WAN connection has not arrived, when it does we'll repeat that test.

 

[bobmc]

I would also try and establish if WAN2 works when connected to WAN1 on the hardware pfsense - you may need to see if the WAN address is static or assigned and make the relevant changes, reverting back once you've established that WAN2 is working.

 

[jerry001]

Thanks for the info @bobmc.

My isp modem unfortunately doesnt support that, and I ended up letting it as it is. My challenge is at with pfsense now, and my scenario requires me to access from some other machine at isp modem network.

What i did for now is to create another VM at vmbr0 and im 'jumping' from it to other networks.. until I can understand what is this pfsense selective behavior at nat port forward. (I´ve read something related to the fact that when there is the pfs managment interface on the way, it may cause that, ill try to dig more later) And I´ve also posted at pfsense forum ,.. lets see

Appreciate your effort in helping me.

Thanks

I am also facing the same issue can you explain me how you figure out your isp modern doesnt support that