I have a PFSense firewall sitting as a gateway for a group of VM's sitting on top of a Xen hypervisor (all machines except for the host are virtual). I have PFSense acting as a waypoint for me to be able to route traffic out to the Internet as my hosting provider does a thing where if you want devices to connect at all you have to have a failover IP assigned to a virtual MAC for it to go out to their network so I figured I'd just port forward on this one public address for when I need to. Sounds good right?
PFSense also has an IPv6 exit (just for the sake of dual-stacking and if I only want a host to have an IPv6 address for individual reachability)
From PFSense itself I can ping,curl,dig...etc on its public IPv4 address however the same cannot be done for clients on the LAN network. For whatever reason that traffic is lost and not sent out. I've checked the packet capture on the public WAN interface and I do not see the packets going out to the Internet. I've checked the firewall to see if it was being filtered but no. I'm using the default rules from install.
All VM's are using e1000e as their virtual ethernet adapter and from what I can tell it SHOULD be working. IPv6 connectivity works just fine and I can confirm its not a LAN issue as I can connect normally using the LAN IP addresses to each box inside that.
Topo:
[ISP] -> (eno3) [Xen Host] (br0) -> (xn0) [PFSense] (xn1) -> (br1) -> [client01]
br0 - Bridged adapter for eno3 on the host. Things that are connected here have a public IPv4 address and a virtual MAC set which allow the ISP to route traffic back to the individual IP.
br1 - Bridged adapter for virtual machines + PFSense's LAN interface.
All bridges are located on the Xen host. EDIT: Forgot to mention. I can use ICMP from all guests just fine (ex: ping 8.8.8.8) and those work just fine.
0 Answers