0

I have a public network, 123.123.123.0/28, and a local network, 192.168.1.0/24. My ISP gateway for the public network is 123.123.123.1. My virtual firewall and router (pfsense) is running inside Proxmox VE, along with all the other (virtual) servers. My main server is connected to the switch, which is directly connected to the ISP.

|~~~~~~~~~~~~|
|   SWITCH   |
|[ ][ ][x][x]|      (~~~~~~~~~~~~~~~~~~)
|~~~~~~~|~~|~|      ( Local ISP router ) 123.123.123.1/28
        |  |_______ (~~~~~~~~~~~~~~~~~~)
        |
|~~~~~~[x]~~~~~~~~~~|
|       SERVER      |  192.168.1.10/24 (local network)
| _______PVE_______ |
| |               | |
| |   (pfsense)   | |  123.123.123.2/28, 192.168.1.2/24
| | (web-server1) | |  123.123.123.3/28
| | (web-server2) | |  123.123.123.4/28
| |~~~~~~~~~~~~~~~| |
|~~~~~~~~~~~~~~~~~~~|

I can easily force all outgoing and incoming traffic from the local network via pfsense, ensuring it's safe using NAT and a firewall, by setting it as a gateway. This way, the local main server can access the internet but remains invisible from the outside, making it much harder to break into.

On the other hand, for web-servers 1 and 2, which should be visible to the public, I can only monitor and filter outgoing traffic (by setting the gateway to pfsense instead of the ISP), but incoming traffic from the ISP will "flow around" it since it's the same network.

Is it possible to somehow force all public outgoing and incoming traffic through pfsense without having any control over the local ISP gateway?

I'm also using the built-in PVE firewall, but that is outside the scope of this question.

2
  • A common way is to privately address the servers and perform a one-to-one NAT on the firewall for the DMZ.
    – Ron Maupin
    Oct 19, 2023 at 13:07
  • @RonMaupin, thanks, I'll look into it, wasn't familiar with 1:1 nat
    – Demiler
    Oct 19, 2023 at 13:29

1 Answer 1

0

Is it possible to somehow force all public outgoing and incoming traffic through pfsense without having any control over the local ISP gateway?

Absolutely. When the pfSense is the (only) gateway between your ISP router and your LAN, all traffic needs to pass through it.

Currently, your publicly visible servers seem to be connected in parallel to the pfSense which can't protect them that way. Generally, there are two methods to move the servers behind the firewall: bridged (L2) or routed (L3).

Bridged requires two (VLAN) interfaces on the pfSense. One connects to the WAN (VLAN) interface of your ISP router (a switch in between doesn't matter). The other connects to another VLAN where your servers are located. (Not familiar with pfSense, so I'm not sure whether bridging is possible there - sometimes it's call (transparent) wire mode).

The routed method requires separate IP subnets (and VLANs) between ISP router and servers - since that is not possible currently, you need to move the servers into a private subnet. Then you bind all their required public IP addresses to the pfSense instead and destination NAT/port forward from there to the respective server.

1
  • Thanks! I didn't think of port forwarding
    – Demiler
    Oct 19, 2023 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.