1

I have the following network: - Edge Lite 3 router with public IP on WAN (eth0) and 2 LANs: 1) eth1 192.168.1.11/24 2) eth2 192.168.2.11/24

eth1 is DHCP, I have several work laptops inside.

eth2 goes to a pfSense firewall with ip 192.168.2.1 (on its WAN interface)

I have NAT rules for several ports I need, from WAN to 192.168.2.1.

The LAN ip of pfSense the IP is 192.168.100.1/24

Behind it I have a web/dc/sql server (192.168.100.2), a NAS (192.168.100.3), another DC (192.168.100.4) and we continue to add as we separate and scale the roles.

pfSense has NAT rules from WAN to the web server 192.168.100.2 (we we are in the double NAT scenario).

The website works with no issues, being accessible from the internet.

The 2 LAN interfaces eth1 and eth2 of the Edge router should be independent, we don't want to be able to directly access eth2 from eth1 laptops.

Network diagram:

enter image description here

What we need is to access the website from the machines in eth1. Currently we have the error 404 not found in browsers.

nslookup shows server unknown with address 192.168.1.11, and for the non-authoritative address, the correct name and public ip.

tracert for the website name has one step, the public ip.

How can we do for the requests from eth1 (workstations in DHCP) to be treated by pfSense like any other requests from the internet?

Many thanks!

Improve this question
3
  • "and remove NAT from pfSense (though the security will kill me)." NAT has nothing to do with security. The firewall is what provides security. NAT should only be used where it must be used (private to public addressing or overlapping addressing). A firewall will, by default, drop any unsolicited traffic, and you then set up rules to allow specific traffic. Thinking that NAT provides security is a rookie mistake.
    – Ron Maupin ♦
    Jan 3, 2019 at 14:57
  • Hi Ron, thanks for the answer! pfSense interface has NAT under the Firewall section and that tricks me. For each NAT port forward, I created a rule (443 Pass, 80 Pass). When the pfSense was installed for me, I understood from the pfSense engineers that each port that is not explicitly "NATed", is by default not forwarded. And for each port forward with no rule configured, the default action is Block. So as I understood, NAT is the opposite to security because I open and let pass traffic through ports. My question still remains...
    – Alexandru Cojocaru
    Jan 4, 2019 at 12:21
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Apr 19, 2019 at 6:25

2 Answers 2

Reset to default
1

You'll want to bypass your router/firewall completely for internal services, whether or not they are destination NATed from WAN.

The easiest solution is split-brain DNS - just set up records/zones on your DNS server and point the external names to the internal IP addresses. Make sure your internal clients use that DNS server (you could block their access to external DNS on the firewall).

Essentially, instead of using the public DNS record, www.website.com => public WAN IP, and destination NATing public WAN IP to 192.168.100.2, your internal DNS resolves www.website.com directly to 192.168.100.2. No need for NAT at all.

Resolving the external names to public IP addresses requires "hairpinning" on the router/firewall, including destination NAT and usually source NAT for the client. That can cause severe performance penalties (if at all possible) and also hides the client IPs behind the firewall IP. Using split-brain DNS extremely simplifies the setup.

Improve this answer
13
  • Thanks for the very clear answer!! I have DNS forward lookup zone corp.mydomain.com behind the pfSense (192.168.100.1) The primary DNS server on pfSense is set to be 192.168.100.2 Can I accomplish the same by updating the hosts file on all work machines in LAN1 with an entry for www.mydomain.com? I tried 192.168.2.11 www.mydomain.com ==> this doesn't change anything, same as the current default functioning. This IP resolves to the EdgeOS interface so when I ask my webpage I get 404 (not found). 192.168.2.1 www.mydomain.com ==> connection timed out, can't even ping this..
    – Alexandru Cojocaru
    Dec 30, 2018 at 10:55
  • I can create a new forward lookup zone for www.mydomain.com and remove NAT from pfSense (though the security will kill me). But how will this help the workstations in LAN1 of Edge, since they can't get to 192.168.2.1, the WAN interface of pfSense?
    – Alexandru Cojocaru
    Dec 30, 2018 at 11:03
  • You could use the hosts files, but they're a pain to maintain. If you ping by name and see the private IP it's working. However, host-related issues are off-topic here. The 404 error probably originates from dNATing port 80 on the outside interface, but not on the inside interface where you might access the pfSense's web console.
    – Zac67 ♦
    Dec 30, 2018 at 12:08
  • When I ping www.mydomain.com I get the public static ip and when I trace route, there is only one hop: to the internet service provider public static ip. But as you said, this is what the global DNS resolves. This is not the real physical route from LAN1 workstations to pfSense in LAN2... There is no physical route, the interfaces are separated. Port 80 and 443 are NATed on both the outside Edge route and the pfSense firewall.
    – Alexandru Cojocaru
    Dec 31, 2018 at 12:14
  • When you ping www.mydomain.com that resolves to the firewall's public IP, you don't actually ping the website but the firewall. With split-brain DNS you'd see the private IP of your webserver and ping that.
    – Zac67 ♦
    Dec 31, 2018 at 12:21
0

The only solution that worked was the workaround to access the site from the laptop with VPN.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.