2

I have just installed pfsense 2.4 for a SOHO I work and I'm getting problems with the routing. I have asked my ISP for a /29 network with public ips for the DMZ, but instead of giving my directly what I asked they gave me a this:

WAN 10.219.16.244/30

LAN 152.206.43.32/29

(these are not the real ips the gave me)

So, I have something like this:

enter image description here

the connection between my pfsense and the isp gateway works just fine but there is no way i get internet connection. What I'm missing here?

(I've done this before but with a public IP on the WAN side)

Hope you could help me! Thanks anyway

Improve this question
14
  • Are you sure they didn't just typo, say LAN on that line when they meant WAN? Have you tried it in reverse, is what I'm asking.
    – Jesse P.
    Oct 4, 2019 at 21:37
  • no, i am pretty sure that is what they meant. In fact, i called my isp and asked them about it and they reassured it was correct.
    – Jorge Regalado
    Oct 4, 2019 at 23:10
  • 1
    First, we really need to see the router configuration. Please copy it and paste it into the question using the Preformatted-text option ({}). It sounds like you are using a residential ISP that is using CGNAT, and that is going to prevent access from the public Internet if you have a double NAT.
    – Ron Maupin ♦
    Oct 5, 2019 at 0:15
  • @RonMaupin Maybe but I've not ever seen a residential account that the ISP allowed to have a /29, since that implies you're operating a business which they frown upon (from my experience) and require you to upgrade to a business-class connection to be able to get a anything other than a single IP address.
    – Jesse P.
    Oct 5, 2019 at 0:51
  • 1
    @JesseP. I have, in the past, leased a block of IPv4 addresses from a residential ISP. They simply charge more for that, and it ends up costing a lot more than a standard residential account, but without the protections of a business contract.
    – Ron Maupin ♦
    Oct 5, 2019 at 0:55

2 Answers 2

Reset to default
1

there is no way i get internet connection.

What makes you say that? While it is highly discouraged for non-NAT'd interfaces to have private addresses, it happens all over the place. No, the internet cannot talk to the WAN interfaces when they don't have global addresses, but that has nothing to do with how they route traffic. When a packet with src:152.206.43.33-dst:8.8.8.8 arrives on either side of the WAN, the router will route them as-is. The rest of the internet will not know that packet crossed a private addressed link, or a link with no address at all.

You will need to take steps to prevent pfsense from trying to use it's private WAN address to talk to things on the internet. (obviously)

(If the router (pfsense) needs to send an ICMP error, the RFC1918 address could be a problem, which is why use of non-nat'd private addresses is not recommended. On some systems it's possible to configure which interface is used for ICMP errors.)

(See Also: Cisco's ip unnumbered)

Improve this answer
1

It looks like they're just sending the route for your public block to their equipment, which then routes it to your pfSense via the /30 access segment (no NAT being done - just handing off the connection between interfaces on the ISP equipment), which they then expect you to NAT or forward on to another device behind the pfSense (to do the NAT there), like just using the pfSense as a router without translation, and having another device to perform the NAT later in the path.

Basically, on your pfSense, you need to set its default route to be the ISPs side of the /30 segment. Then, set an interface on the pfSense with the first host IP address on the /29 (to be your gateway for the other hosts), then on your DMZ (whatever that is), you would assign your other IP addresses and set the gateway to be your pfSense.

Improve this answer
10
  • 1
    i beleive you are on the right track.
    – Jorge Regalado
    Oct 5, 2019 at 1:03
  • i believe you are on the right track and i have done mostly as you said. my pfsense default gateway is the first available ip of the /30 wan network, the other ip is in my pfsense wan interface. in fact i can do ping to the gateway in the isp. so far so good. in the lan side of my pfsense i got the first ip of the /29 (those that are public ips). i disabled nat rules created by pfsense by default since i dont believe i have to nat (why should i nat public ips to privates ips to get to the internet?) do you agree with me?
    – Jorge Regalado
    Oct 5, 2019 at 1:22
  • @JorgeRegalado You don't have to use NAT if you don't want to - your servers can have public IP addresses directly - but adding NAT allows you have more hosts than what would be allowed if you assign the public IP addresses to your servers directly. You could have hundreds of servers behind a single public IP address if you add NAT into the mix. It's ultimately your call - I can't answer that for you. Additionally, NAT adds a layer of obscurity to hide your server's real addresses and your internal subnet architecture.
    – Jesse P.
    Oct 5, 2019 at 1:34
  • I understand what you say. What i really meant Is that apparently the problem should not be that i am not doing nat from my lan to wan. If so, what else could ir be?
    – Jorge Regalado
    Oct 5, 2019 at 1:43
  • @JorgeRegalado Did you assign something in your DMZ one of the other /29 addresses, with the pfSense set as the default gateway for the DMZ server, and see if you can reach the internet?
    – Jesse P.
    Oct 5, 2019 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.