0

I have a Proxmox 5.1-35 server running on HP Proliant ML350 Gen9. After just installed Proxmox using a USB stick I created a pfSense Virtual Machine (VM) and defined three network interfaces (vmbr0, vmbr1 and vmbr2). Each network interfaces on pfSense are named as follows LAN, WAN and SERVERS.

Relation between network interfaces and subnet names:

  • vmbr0 for SERVERS
  • vmbr1 for WAN
  • vmbr2 for LAN

Network diagram:

With pfSense just installed I was able to access internet from LAN subnet (192.168.1.0/24). But ping from LAN subnet to SERVER subnet (172.16.10.0/24) has replies from one server (Proxy) but not from another (FreeNAS). However, firewall (172.16.10.254) can ping any server which is rare because how firewall can ping the FreeNAS (172.16.10.10) and it is not able to forward ICMP packets coming from LAN to FreeNAS. As I said before, he does allow LAN to reach Proxy (172.16.10.2) using ICMP wich is in SERVER subnet with FreeNAS. Also, LAN can ping Proxmox (172.16.10.101)

I'd like to clarify there is no switch involved between LAN and SERVER. All comunication (except WAN) is on the HP Proliant ML350 Gen9 server itself (picture below)

Physical server

For more info I am posting the steps from the beginning:

1- Proxmox after install with no VM or Container (CT)

Proxmox

2- Creating the pfSense VM

3- pfSense was installed without any issue. Check the red boxes (version check and NTP request worked). So pfSense is reaching internet on WAN

pfSense dashboard

4- I never modified any rules on any subnet in pfSense Rules tab. Almost everything is on default values

WAN Rules WAN

SERVERS Rules SERVERS

LAN Rules LAN

5- Creating the Proxy server CT

Proxy CT creation

6- FreeNAS is a physical server connected to the HP Proliant server through the gray UTP Cat5e wire.

So far I've created a VM (pfSense) and a CT (Proxy). Now I'm going to show the ping tests. Again, there is no problem for accessing internet from LAN. SERVERS can not ping anything outside the subnet but I guess it's because SERVERS Rules tab is blank. pfSense is denying packets by default from SERVERS.

PING from LAN

PC -> 172.16.10.2

PC -> 172.16.10.10 (WHY???)

PC -> 172.16.10.101

PC -> 172.16.10.254

PING from firewall (172.16.10.254)

firewall (172.16.10.254) -> 172.16.10.2

firewall (172.16.10.254) -> 172.16.10.10

firewall (172.16.10.254) -> 172.16.10.101

Firewall can reach the entire SERVERS subnet even FreeNAS using ping so why is not forwarding LAN -> FreeNAS?

PING from Proxy (172.16.10.2)

Proxy (172.16.10.2) -> 172.16.10.10

Proxy (172.16.10.2) -> 172.16.10.101

Proxy (172.16.10.2) -> 172.16.10.254

PING from FreeNAS (172.16.10.10)

FreeNAS (172.16.10.10) -> 172.16.10.2

FreeNAS (172.16.10.10) -> 172.16.10.101

FreeNAS (172.16.10.10) -> 172.16.10.254

Not posting PING test on 172.16.10.101 because there is a lot of pictures on this post.

Finally, this the packet capture feature on pfSense from Source 192.168.1.111 to Destination 172.16.10.10

pfSense is getting the request but is not having a reply back from FreeNAS. This question is very serious for me because pfSense (as a firewall) is the very foundation on any network. I have to say this example is for diagnose and I created all pictures from the beginning because this problem happened my before with Windows Server 2012 R2 just like FreeNAS. I put Windows Server 2012 R2 aside because I thought it was a Virtio Adapter problem in the VM settings. Now I see there is a problem or I am not getting the network concept very well.

The network schema is very very basic, why am I having this problem? I decided to stop and ask because better to fix this now than having a worse problem later.

0

The "detail" was I did not defined a gateway for FreeNAS and Proxy (when creating the container in proxmox) does have a gateway configuration (172.16.10.254). After changing this I was able to get a reply ICMP packet coming from FreeNAS. More info can be found here: pfSense's forum post about the problem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.