8

The Setup

I have setup pfSense 2.0.1 (64bit-amd image) as a host in Hyper-V. As described in other blogs I had to do the “ifconfig down deX”, “ifconfig up deX” to get the network up and running.

The server (HP running Windows 2008 R2) is equipped with two physical NICs.

  • The first physical NIC (port 1) is not configured in the host (only as Hyper-V switch, see further down).

  • The second physical NIC (port 2) is configured with a network for remote management (standard C-class network). I think both NICs are connected to the same switch and VLAN=default (the physical wiring was done by my co-location provider).

In Hyper-V there are the following virtual networks defined:

  • internal: virtual machine internal network used for inter VM communication (“LAN” connecting the Windows servers).

  • Internet: virtual network used as WAN connection for pfSense. This network is assigned to the first physical NIC (port 1) of the server. The virtual network is dedicated for Hyper-V and is not shared with the host.

In my setup I use pfSense as the Internet facing firewall for a couple of virtual machines (Windows servers) also running on the same Hyper-V host.

The Windows boxes use the pfSense as default gateway and I successfully downloaded Windows updates to all VMs through pfSense firewall – working smooth.

For re-directing incoming services, the pfSense is setup with 1-1 NAT to map ISPs IP-addresses to internal 172.16.0.0/16 addresses on the Windows boxes.

The problem

The problem I had is that after working successfully with a RDP connection over the management network (port 2), the connection just dies and all network connectivity is lost to the server and VMs. Before the problem occurred I did two configuration changes.

  1. Moved the management IP address from port 1 to port 2. This change was successfully verified by re-connecting RDP one hour later on the new interface (port 2 as described above).

  2. Did some configurations on the virtual IPs in pfSense (needed for the 1-1 NAT).

Some minutes later the connectivity to the machine was lost.

The thing that puzzles me is that management network connection (port 2) is supposed to be untouched by Hyper-V since it is not integrated with Hyper-V. However there seem to be error propagation from pfSense (using NIC on port 1).

Earlier today we had a similar problem when using only one NIC (port 1 shared between Hyper-V/pfSense and the host). The problem we got then was that when pfSense was stopped we could ping the host and when it was started again the ping stopped working (no IP conflict what we know).

The pfSense is installed from the ISO and the “MAC Address spoofing” is default = off.

Since the problem seam to propagate between the two physical ports my guess is that this might have something to do with ARP not working correctly.

Any insights comments on this very much appreciated.

/ J

Jon Martinsson
  • 81

2 Answers2

1

Did you checked the Event Viewer on the W2008R2 ?

Could be due to max TCP connections allowed by Windows: https://technet.microsoft.com/en-us/library/cc759700%28WS.10%29.aspx

pfSense as a software router uses lots of connections which can be opened but not closed, waiting status and so on. This kind of network use can achieve the default limits of TCP stack and windows could close or not allow more connections of this type. The first thing to do on this case it's to check Event Viewer to see if something it's reported there.

NetVicious
  • 512
0

This is sounding more like a routing issue between pfSense and the other devices...

If you are using the Virtual Machines behind the pFSense as a firewall, however you need them on a different SubNet than the PC's on the lan. You may have to turn up an additional interface on pfSense (LAN2 say) Then map it in the VM Host to a private VSwitch that the other VMs are using.. Or even TAG the traffic in the vSwitch and have seperate vlan for it.

I have had to do this many times on VMWare. Also for your 1:1 's you may have to add static network route mapping for those as example. I have seen pfSe nse get its routing messed up.

That way you have..

IINTERNET --> Wan0 -->pFSense -->LAN1 PCs..

                  pfSense -->LAN2 Virtual Machines.

After that you can control the routing and firewall rules better.

Hope this helps, Cheers...

David Thomson
  • 167