I have a VMware vSphere Hypervisor with several Hadoop VMs running. Since our support activated Port Security on our router, only two MACs are allowed to be connected to one port of the router. This is why I added another VM with pfsense, put the Hadoop VMs in their own subnet, and the pfsense VM "in-between":
My preferred solution would be that pfsense works transparent, only replacing all the MACs with it's own for packets that go to the "outside". As I don't know whether that is possible, I am currently trying to get outbound NAT working, so that at least those VMs can communicate to the outside.
So far I have:
- connectivity between the Hadoop VMs (and the LAN interface of pfsense)
- connectivity between the WAN interface of pfsense and the "outside", including DNS
What doesn't work:
- I have no connectivity between the Hadoop VMs and the outside (in both directions)
My WAN is 22.214.171.124/24. Since my original plan is to somehow make communication between LAN and WAN transparent, I configured pfsense such that for pfsense, the LAN is 172.16.40.128/25 while the WAN is 172.16.40.1/25.
Here are my firewall rules and NAT rules:
WAN firewall rules
ID Proto Source Port Destination Port Gateway Queue Schedule Description IPv4 TCP * * WAN address 80 (HTTP) * none WAN configurator access IPv4 * 172.16.40.0/24 * * * * none WAN/LAN Passthrough IPv4 * * * * * * none anypass
LAN firewall rules
ID Proto Source Port Destination Port Gateway Queue Schedule Description * * * LAN Address 80 * * Anti-Lockout Rule IPv4 * LAN net * * * * none Default allow LAN to any rule IPv6 * LAN net * * * * none Default allow LAN IPv6 to any IPv4 * * * * * * none anypass
Outbound NAT rules
Interface Source Source Port Destination Destination Port NAT Address NAT Port Static Port Description WAN 172.16.40.128/25 * * 500 WAN address * YES Auto created rule for ISAKMP - LAN to WAN WAN 172.16.40.128/25 * * * WAN address * NO Auto created rule for LAN to WAN WAN 127.0.0.0/8 * * * WAN address 1024:65535 NO Auto created rule for localhost to WAN WAN any * * * WAN address * NO NAT everything