Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The Setup

I have setup pfSense 2.0.1 (64bit-amd image) as a host in Hyper-V. As described in other blogs I had to do the “ifconfig down deX”, “ifconfig up deX” to get the network up and running.

The server (HP running Windows 2008 R2) is equipped with two physical NICs.

  • The first physical NIC (port 1) is not configured in the host (only as Hyper-V switch, see further down).

  • The second physical NIC (port 2) is configured with a network for remote management (standard C-class network). I think both NICs are connected to the same switch and VLAN=default (the physical wiring was done by my co-location provider).

In Hyper-V there are the following virtual networks defined:

  • internal: virtual machine internal network used for inter VM communication (“LAN” connecting the Windows servers).

  • Internet: virtual network used as WAN connection for pfSense. This network is assigned to the first physical NIC (port 1) of the server. The virtual network is dedicated for Hyper-V and is not shared with the host.

In my setup I use pfSense as the Internet facing firewall for a couple of virtual machines (Windows servers) also running on the same Hyper-V host.

The Windows boxes use the pfSense as default gateway and I successfully downloaded Windows updates to all VMs through pfSense firewall – working smooth.

For re-directing incoming services, the pfSense is setup with 1-1 NAT to map ISPs IP-addresses to internal 172.16.0.0/16 addresses on the Windows boxes.

The problem

The problem I had is that after working successfully with a RDP connection over the management network (port 2), the connection just dies and all network connectivity is lost to the server and VMs. Before the problem occurred I did two configuration changes.

  1. Moved the management IP address from port 1 to port 2. This change was successfully verified by re-connecting RDP one hour later on the new interface (port 2 as described above).

  2. Did some configurations on the virtual IPs in pfSense (needed for the 1-1 NAT).

Some minutes later the connectivity to the machine was lost.

The thing that puzzles me is that management network connection (port 2) is supposed to be untouched by Hyper-V since it is not integrated with Hyper-V. However there seem to be error propagation from pfSense (using NIC on port 1).

Earlier today we had a similar problem when using only one NIC (port 1 shared between Hyper-V/pfSense and the host). The problem we got then was that when pfSense was stopped we could ping the host and when it was started again the ping stopped working (no IP conflict what we know).

The pfSense is installed from the ISO and the “MAC Address spoofing” is default = off.

Since the problem seam to propagate between the two physical ports my guess is that this might have something to do with ARP not working correctly.

Any insights comments on this very much appreciated.

/ J

share|improve this question
    
You did a god job of explaining the problem. But you don't say what changes you made. Can you list the actual (or obfuscated) IP addresses used as virtual and management IP and the actual changes done parts #1 and #2? –  Andy Shinn Feb 12 '13 at 23:25
    
Are you debugging this locally (same switch for server and your client) ? I'm asking because you could be assuming pfSense/Hyper-V are the source of the problem when in fact it could a firewall/proxy somewhere expiring your stateful connections. Try to be as close as possible to this host and leave tcpdump and Wireshark running on pfSense and Windows, respectively, then check what is happening. Also, since you swapped the interfaces, double check everything in Hyper-V's virtual switch. –  gtirloni Aug 11 at 18:10
    
Did you activated promiscuous mode on the virtual interface ? you'll need to activate that for firewalls: By default, a guest operating system's virtual network adapter only receives frames that are meant for it. Placing the guest's network adapter in promiscuous mode causes it to receive all frames passed on the virtual switch that are allowed under the VLAN policy for the associated portgroup. This can be useful for intrusion detection monitoring or if a sniffer needs to analyze all traffic on the network segment. –  MrLightBulp Nov 28 at 14:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.