3

really need help since I am still new in firewall. I have 2 firewall located in two separate Datacentres. I need to make a connection for the servers from these 2 DCs. One firewall is running pfsense and another is running redhat. Is there a way or technologies that can make these firewalls communicate?

Improve this question
2
  • The most critical "technology" in this case is the Internet. Since there are some ... security concerns surrounding this technology, you might consider looking at the VPN options available to each of these two firewall tools. Often people find it simplest to have the same make / model on both sides of a VPN link, but your mileage may vary.
    – Slartibartfast
    Apr 12, 2018 at 1:37
  • can IPsec establish a connection for both firewall?
    – user3557434
    Apr 12, 2018 at 6:17

1 Answer 1

Reset to default
1

Ok, so as I understand your scenario you have two networks that you control both behind firewalls, one redhat based, one pfsense based. These firewalls are connected via the Internet. You want to allow servers on your two networks to be able to talk to each other more freely than they can talk to the Internet in general.

Broadly speaking there are three approaches.

  1. Just open up holes in the filters. This only works if the servers behind the firewalls have public IPs. It also leaves your traffic vulnerable to sniffing, hijacking and injection as it passes over the internet.
  2. Unencrypted tunneling. The packets are encapsulated so they can travel over the internet despite carrying private addresses but no encryption is used, so the packets are still vulnerable to sniffing hijacking and injection.
  3. Encyrpted tunneling. The packets are encrypted and authenticated as well as being encapsulated. So (provided the cryptography holds up) they are protected from sniffing hijacking and injection.

There are many different protocols that can be used for 2 and 3, I have personally tended to use openvpn but others may have their own preferences.

Assuming you plan to use approach 2 or 3 the procedure for setting it up would go something along the lines of.

  1. Make sure you don't have any IP conflicts, renumber if nessacery (if you really have to there are ways of dealing with overlapping IPs but they are beyond the scope of this answer).
  2. Establish the tunnel between the two firewalls. The tunnel should have it's own IP addresses which are distinct from those used on any other network. Check that the firewalls can communicate with each other over the tunnel.
  3. Add routes on the two firewalls to send traffic down the tunnel.
  4. Add firewall rules to permit the traffic to be forwarded to/from the tunnel.
Improve this answer
2
  • Thank you for the explanations. So if one of my firewall is using pfsense and IPSec enabled. Can the communication between network established by enabling IPsec inside the redhat based firewall?. I will continue to learn about Openvpn too.
    – user3557434
    Apr 12, 2018 at 6:14
  • "Can the communication between network established by enabling IPsec inside the redhat based firewall?" I'm pretty sure it is possible but since I don't use redhat, pfsense or ipsec myself I can't help you in setting it up.
    – Peter Green
    Apr 12, 2018 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.