1

I have a VMware vSphere Hypervisor with several Hadoop VMs running. Since our support activated Port Security on our router, only two MACs are allowed to be connected to one port of the router. This is why I added another VM with pfsense, put the Hadoop VMs in their own subnet, and the pfsense VM "in-between":

enter image description here

My preferred solution would be that pfsense works transparent, only replacing all the MACs with it's own for packets that go to the "outside". As I don't know whether that is possible, I am currently trying to get outbound NAT working, so that at least those VMs can communicate to the outside.

So far I have:

  • connectivity between the Hadoop VMs (and the LAN interface of pfsense)
  • connectivity between the WAN interface of pfsense and the "outside", including DNS

What doesn't work:

  • I have no connectivity between the Hadoop VMs and the outside (in both directions)

Configuration details:

My WAN is 172.1.40.1/24. Since my original plan is to somehow make communication between LAN and WAN transparent, I configured pfsense such that for pfsense, the LAN is 172.16.40.128/25 while the WAN is 172.16.40.1/25.

Here are my firewall rules and NAT rules:

WAN firewall rules

ID  Proto   Source  Port    Destination     Port    Gateway     Queue   Schedule    Description     

    IPv4 TCP    *   *   WAN address     80 (HTTP)   *   none        WAN configurator access     
    IPv4 *  172.16.40.0/24  *   *   *   *   none        WAN/LAN Passthrough     
    IPv4 *  *   *   *   *   *   none        anypass  

LAN firewall rules

ID  Proto   Source  Port    Destination     Port    Gateway     Queue   Schedule    Description     

    *   *   *   LAN Address     80  *   *       Anti-Lockout Rule   
    IPv4 *  LAN net     *   *   *   *   none        Default allow LAN to any rule   
    IPv6 *  LAN net     *   *   *   *   none        Default allow LAN IPv6 to any 
    IPv4 *  *   *   *   *   *   none        anypass  

Outbound NAT rules

Interface   Source  Source Port     Destination     Destination Port    NAT Address     NAT Port    Static Port     Description     
    WAN     172.16.40.128/25    *   *   500     WAN address     *   YES     Auto created rule for ISAKMP - LAN to WAN   
    WAN     172.16.40.128/25    *   *   *   WAN address     *   NO  Auto created rule for LAN to WAN    
    WAN     127.0.0.0/8     *   *   *   WAN address     1024:65535  NO  Auto created rule for localhost to WAN      
    WAN     any     *   *   *   WAN address     *   NO  NAT everything 
  • 3
    You are clearly trying to solve the organizational problem with technical methods. This is counter-productive and time-consuming. – drookie Jan 27 '15 at 11:18
  • NAT has nothing to do with MAC addresses. NAT translates layer-3 addresses, not layer-2 addresses. Layer-2 addresses get stripped off when a frame reaches a layer-3 device, e.g. router, and replaced on the next link. A MAC address is only valid on the layer-2 LAN where the device with that address is, and layer-3 devices bound layer-2 LANs. – Ron Maupin Jul 8 '16 at 12:59
0
  1. Remove the "WAN any * * * WAN address * NO NAT everything" in the Outbound NAT rules

  2. Check the logs of the firewall on Status / System Logs / Tab Firewall write here which logs you have there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.