How can I configure access to pfSense on Xen

Question

I have a new Xen installation on which I want to run virtual machines. My hoster provided me two separate IPs in different subnets, say x.x.x.x and y.y.y.y.

I want to set up pfSense on Xen and assign y.y.y.y to it so that it would serve as a router and DHCP for other virtual machines, giving them addresses in 192.168.0.0/16 subnet. Is it possible to do so? How should I configure network on Xen to do that?

I've set up packet forwarding in sysctl

net.ipv4.ip_forward = 1

and now pfsense can ping and traceroute resources in internet. But obviously is is unreachable from internet by its ip y.y.y.y

Answer 1

To clarify, x.x.x.x and y.y.y.y are both public IPs? so you will use x.x.x.x as your public facing IP that you can access externally, but you want to block the internet from reaching y.y.y.y?

while this is slightly offtopic right here, i would suggest (if you have 2 nics) created a bonded channel so you have some redundancy with your 2 public IPs.

For your internal side where you want to provide "routing" (is this a nat gateway?) and dhcp, you should probably use a private ip. you would need them to be in the same network and with only 2 IPs, you wouldnt have anything for your other virtual machines.

to your specific question though, the answer is yes, you can do this. when you setup pfsense, there is a config tool and it will ask you some questions about your network. if you are using the vm ovf then in the 'notes' of the vm it tells you how to set it up. regardless just go through either the web gui or the command line questions. tell it your external IP, your internal subnet (192.168.0.0/16)

that all being said, by default pfsense allows outbound nat between your LAN and WAN.

The below will show all auto-created rules, which you can delete if you need to customize them.

go to Firewall -> NAT -> Outbound, and enable AON / Manual Outbound NAT. 

sidenote: be advised that in a xen environment, unless this changed, you are limited to 100Mbps on the vnics you get. I'm not sure if this is still the cased as I swapped to esxi because of it.

---

I would like to get some clarification. Is your x.x.x.x accessible from the internet? I see you mentioned that you can get out. If you can not get back in, this could be a firewall issue.

Are you able to access the internal (or external) interfaces from anywhere? By this i mean, can you bring up the GUI? Assuming that your internal network is on RFC1918 space, ensure that your internal interface of pfSense is also on this same network. Verify by ping and ensure that you let pfSense know this is your internal interface. You should be able to browse to it with your choice of browser.

Once you are in the gui, you will see things similar to home routers. You can set up port forwarding and tweak the NAT settings. By default pfSense NATs your internal network out but without any port forwarding.

I guess I am still confused on whether you have external access? If you are able to get out from your pfSense box and you can ping your internal network, assuming you didn't touch NAT it should work. Can you elaborate a little more on your current configuration? You cannot use y.y.y.y as your internal interface (unless you perhaps use a sub-interface that your lan can speak to and nat that to y.y.y.y but that's a little ridiculous)

LAN (192.168.1.0/24) -> pfSense Internal (192.168.1.254) -> NAT -> pfSense External (x.x.x.x) -> Internet.

return traffic will only be allowed based on your inbound firewall rules and port forwarding.

to assist more, can you do the following:

from your pfSense, paste your ping to google.com from your pfSense, paste a ping to one of your internal lan machines

be sure to redact your public IP :)

Answer 2

Assuming you have just one network interface in that physical machine you will have to do a bit of juggling with routing and firewalling. That's because one NIC will actually have to communicate with 3 different networks: 1. Your ISP; 2. Your y.y.y.y being the pfSense router/gw for LAN; 3. Internal LAN-facing 192.168.0.0/16 subnet. You may look at vtun (Debian/Ubuntu) to create virtual networks.

You've stated that: "pfsense can ping and traceroute resources in internet. But obviously is is unreachable from internet by its ip y.y.y.y". This indicates routing issues on x.x.x.x server which I presume is physical machine with Xen (and pfSense) virtual machine. Please check if you can reach y.y.y.y from x.x.x.x. Check if there is proper routing set up on the host and virtual machine (if they can reach other other) via tcp/udp (netcat comes in handy as well as tcpdump if you need to see what happens there). Netstat -rn gives you the routing. If routing is missing you can it with: ip add route add y.y.y.y dev ethX Another thing to check is the firewall on your x.x.x.x machine. Check if it lets the traffic pass. "net.ipv4.ip_forward = 1" is one thing but another is iptables filtering or DENY policy.

In order for the whole communication to work properly, each machine needs to know how to reach another one. So test various combinations and if you get stuck somewhere, check the next hop i.e. if pfSense virtual machine cannot reach Internet, check if it has default route entry (most likely via x.x.x.x) and knows how to reach x.x.x.x at all.

These links regarding routing may come in handy: http://www.lartc.org/lartc.html as well as http://www.policyrouting.org/iproute2.doc.html