Were setting up a pfsense box as a virtual machine inside a VMWare ESXi 6.0 environment (inside a VXRail hyper-converged Box).
The target configuration is that to access any machine within this box, you need to go through the Firewall. Traffic between machines within the same box also need to go through the firewall. Since they are different servers e.g. Web Server, Database Server, the VMs are setup to be in different VLANs.
As such, we've setup pfSense with two interfaces. One is the WAN that will be used by the "Outside World" to communicate to servers within the ESXI environment and the other is a Trunk that should then connect to all the VLANs protected by the pfSense box.
We've followed the guide here to setup a Distributed vSwitch in VxRail. we've setup a distributed port group? of VLAN Type VLAN Trunking and with VLAN IDs 0-200:
To our understanding, this Port Group is what we will attach to pfsense Trunk so that it is able to "read" all the VLAN tagged traffic?
Trunk on PfSense:
To create a trunk on pfsense is basically adding the NIC to the pfsense VM. The NIC should be the Port Group we've created above.
VLAN on pfSense:
After that we create a VLAN on pfSense and add a VLAN ID. This VLAN is sitting on the Trunk we've created above. Example below:
We then add an interface based on this VLAN and give it an IP of
We then create a machine that will be protected by the firewall. So first, we add an NIC to it. The NIC is based on a host network that has a VLAN tag e.g. 152 as seen below.
We then assign the protected machine an IP of
192.168.152.10 with a default gateway of
Issue is, after doing all this, the protected machine cannot ping its default gateway. The default gateway cannot ping that machine. It's like there is no communication between them at all. We've added a firewall rule to allow all traffic on Interface152 and logged everything but we cannot see any traffic being accepted or rejected.
What could we have missed? The biggest confusion we have is on the VXRail ESXI setup but any correction on pfSense setup is also welcome.