Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our branch office is unable to connect to our internal network for some reason. However we can connect to the branch office domain controller from behind PfSense. The following is our setup:

                    |Branch DC - 192.168.0.101
                    |
                    |Branch Firewall - 192.168.0.2
                    |
                    |(Internet)
                    |
                    |Local Firewall - 192.168.3.1
                    |
                    |PFSense WAN port - 192.168.3.100
                    |PFSense LAN port - 192.168.1.1
                    |
                    |
   DC1 - 192.168.1.2|DC2 - 192.168.1.4
  • Branch DC can ping and connect to PFSense WebGUI on the WAN port successfully (we set this up using the PfSense documentation).
  • DC1 and DC2 can connect outbound to the Branch DC.

There seems to be a rule that prevents internal access on the WAN port. However our rules are set to allow all traffic on the LAN and WAN ports. It would be ideal to just disable the firewall altogether since we already have a firewall but when we do this, PfSense doesn't allow any internal traffic at all. I look forward to any assistance and thank you ahead of time.

share|improve this question
    
Do you have a (redacted) copy of the firewall rules for both sides of the connection? Is the Branch Firewall running pfsense as well? –  voretaq7 Jun 13 '11 at 19:46
add comment

3 Answers

Without seeing your pfsense rules my inclination is to say "Working As Designed" -- most firewalls are configured to prevent people on the outside (WAN port) from accessing resources on the inside (LAN port).

If you want to let people from the outside in you need to either punch firewall holes (including 1:1 NAT or port redirection, if you're using NAT) or set up a VPN. The latter is a better solution in nearly every case...

share|improve this answer
    
We were trying to avoid using VPN since we already connect to our branch office using a Site-to-Site VPN. Regarding NAT, that would be the only other way then? We basically want our Domain Controllers to begin replicating properly again. –  Sean Jun 13 '11 at 19:53
    
This looks like a setup with a literal dedicated WAN (from the private IP used on it)... –  rackandboneman Dec 14 '12 at 2:57
add comment

As voretaq7 suggested site-to-site VPN is a good solution in your case.

Here is excellent example of site-to-site vpn between Sonicwall and pfSense. If you are using any other firewalls almost the settings will be more or less same.

In case you need more help setting up site-to-site vpn please do not hesitate to get back.

share|improve this answer
add comment

Since you are using pfsense only for internal networks (no internet connection attached directly to it), you should disable Network Address Translation. Internal NAT is a Bad Idea (tm).

From the pfsense WebUI: "To completely disable outbound NAT, switch to Manual Outbound NAT then delete any NAT rules that appear in the list." (can be found in Firewall -> NAT -> Outbound)

Also, you'll need to make sure that a) Branch has a route for 192.168.1.0/24 b) pfSense has a route to 192.168.0.0/24 (Branch)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.