Port forwarding remote traffic through physical router to go through pfsense VM, then to centos VM web server

Question

I hope this makes sense, I'm completely self taught and planning on going for formal instruction. As I understand this is possible, however I haven't been able to find definitive answers to my situation.

I'm trying to use a pfSense VM as a router/firewall to my internal VM network - routing all traffic from VMs through pfsense before the physical router/modem and then to the wild, &vice-versa

I'm having difficulty port forwarding remote incoming traffic from internet through my physical modem/router(192.168.0.1) to my bridged pfSense virtual machine (2 NICs; 1. WAN 192.168.0.30 -- 2. LAN 192.168.1.1) and then through to my centOS web-server (192.168.1.102)

     Physical Modem     Public IP (example 25.60.124.30) not actual ip*

     physical router    cisco default gateway  (192.168.0.1)

     guest VM           pfsense (bridged 192.168.0.30, IntNet 192.168.1.1)

     guest VM           CentOS (IntNet 192.168.1.102)

Currently all of my VMs' outbound traffic go through pfSense and have internet access. It's the incoming traffic to a webserver VM I'm having difficulty with. I've created port forward rules in both my physical router and in pfsense but with no luck.

My question is:

Is it just a matter of port forwarding remote traffic from my public ip address on port 80 to my pfsense WAN ip, and then forward from pfsense to my centOS server?

Ie. remote connection --> my public ip(physical modem/router in my home) --> bridged pfsense vm LAN ip --> centOS VM ip

or

Do I need to somehow port forward from my public ip on port 80 to the WAN on pfsense, then to the LAN ip on pfsense before I forward again to centOS?

ie. remote connection --> my public ip(physical modem/router in my home) --> bridged pfsense vm WAN ip --> bridged pfsense LAN ip --> centOS VM ip

Is there something I'm missing or have I over-simplified this in my mind, and its just not possible?

I'm a noob; please be nice :3

Answer 1

Do I need to somehow port forward from my public ip on port 80 to the WAN on pfsense, then to the LAN ip on pfsense before I forward again to centOS?

Yes - For traffic from the internet

No - For traffic from your lan.

Your setup is a pretty standard lab setup, and you have a few options available to you.

From what I read/what I think... you have:

Public ip on a router WAN and LAN is 192.168.0.1/24

Lab has 2 nics, nic 1 is on your main LAN @ 192.168.0.30/24, and your LAB-LAN nic is 192.168.1.1/24

Based on this, you should actually have full routing from LAN to LAB-LAN, so there are a few different ways of achieving access to a webserver on 192.168.1.102

Access from internet - For this, on your main router (192.168.0.1), you will need to create a port 80 NAT rule that points to the PFSense LAN IP (192.168.0.30). On the PFSense box, you will need to create a NAT rule that points to 192.168.1.102

Access from LAN - For this, you have three options - if you do as above, and your main router supports NAT Loopback (or reflection/similar), you can access the site via:

http://192.168.0.1 (utilising nat loopback on main router)

http://public.ip.goes.here (utilising nat loopback on main router)

http://192.168.0.30 (utilising standard nat rule on pfsense)

Alternatively, as routing should be there, you should also be able to access the site without creating any NAT rules via:

http://192.168.1.102

But, it does sound like you have already tried creating both NAT rules... based on that, I would say check your firewall and possibly on PFSense just set it to disabled for now so it acts as a pure router to make it easier to learn...

Answer 2

It sounds like you have a good use case for your router's DMZ feature. You don't say what your specific router model is, so I can't give specific instructions, but you would want to point the DMZ at your pfSense VM.

What this will do is forward all incomnig (non NAT) traffic to your pfSense VM. You can then use your pfSense to firewall and port forward to your webserver.