Setting up a pfsense router between two private subnetworks

Question

I have a situation like in the picture:

I want to add a pfsense router inside an existing 192.168.1.0/24 subnet and have these possibilities:

• I want the 192.168.73.0/24 network to have access to the internet over the 192.168.1.1 router, and access to the 192.168.1.0/24 network.
• The be able to port forward to servers inside the 192.168.73.0/24 network

I set up:

• 192.168.1.73 interface has gateway set to 192.168.1.2.
• I put firewall rules on Pfsense that lets all traffic everywhere (TCP, UDP and ICMP). (for testing purposes)
• Mikrotik has static route to 192.168.73.0/24 subnet over the 192.168.1.73

The problem I have is Mikrotik can't traceroute inside the 192.168.73.0/24 network (it just jumps to pfsense, and timeout after that). Browsers inside the 192.168.73.0/24 network can't get on the internet. I can connect to the OpenVPN on the pfsense (from the internet), but when connected, I can't access anything except Pfsense. It seems like no traffic is going through Pfsense.

Do I need NAT or not? Do I need static routes (except the Mikrotik one)? I have a feeling I'm missing something, but I don't know what.

Answer 1

A router needs to know where to send traffic, else it will drop the packets with destinations it does not know. Your Internet router will have a default route (matches all destinations) as a route of last resort toward the public Internet, but it needs to know how to reach every internal network.

Routers learn routes in three ways:

• Directly connected networks
• Statically configured routes
• Dynamic routing protocols

Because the networks internal to the pfSense router are not directly connected to either the Internet router nor the MikroTik router, those routers need those networks to be either statically configured to point to the pfSense router, or you need to run a routing protocol so that the routers can exchange routing information.

Do I need NAT or not?

You only use NAT where you must (public<->private or overlapping addressing). You should not use NAT for your internal network because it is unnecessary, and it will cause you problems. You can simply route in your internal network, but all your routers need to know how to reach all your internal networks.

Static routes do not scale, but they may be fine for small sites. Dynamic routing protocols take some configuration, but then you can add and remove networks and they are automatically advertised to all your routers.