D
Deleted member 79566
Guest
This is a continuation of this thread. I'm starting a new thread because it's been a while and because I've made some progress that simplifies the problem, plus I don't need fibs anymore.
I have a FreeBSD box acting as a dedicated firewall, with two interfaces: one connected to my modem (interface igb1) and one connected to my router (interface igb0). The firewall itself can access both the outside world and my local network, but it can't seem to route traffic between the two. (In the previous thread, the connection between the firewall and router was broken completely. I fixed that with dhcpd.)
Here's a general diagram of my setup. Excuse my GIMP:
Routing isn't completely broken, because I see outgoing traffic show up in both interfaces. I'm using Wireshark and ping to test. I can only ping the outside world from the firewall box. If I ping from inside my network, then I see the ping request go through both igb1 and igb0, but I never get a response.
Things I can do:
+ ping the firewall box (as 192.168.2.1) from my local network
+ ping and access services in my local network from the firewall box
+ ping and access the internet from the firewall box
Things I can't do:
+ ping or access the internet from my local network (and probably vice-versa, but I'll worry about port forwarding at a later point)
Note the subnet 192.168.2.0/24 is assigned by the firewall's dhcpd:
- 192.168.2.1 is the firewall (gateway)
- 192.168.2.10 is the router
Below is every config file and command that I thought could possibly be relevant:
cat /etc/rc.conf:
cat /etc/sysctl.conf:
cat /usr/local/etc/dhcpd.conf:
netstat -rn:
(NOTE: I have replaced all mentions of my public IP below with "11.22.33.44", which turns my ISP subnet to "11.22.33.0/23" and ISP gateway to "11.22.33.1".)
ifconfig igb0:
ifconfig igb1:
edit: By the way, it's FreeBSD 14.1 x86_64
I have a FreeBSD box acting as a dedicated firewall, with two interfaces: one connected to my modem (interface igb1) and one connected to my router (interface igb0). The firewall itself can access both the outside world and my local network, but it can't seem to route traffic between the two. (In the previous thread, the connection between the firewall and router was broken completely. I fixed that with dhcpd.)
Here's a general diagram of my setup. Excuse my GIMP:
Routing isn't completely broken, because I see outgoing traffic show up in both interfaces. I'm using Wireshark and ping to test. I can only ping the outside world from the firewall box. If I ping from inside my network, then I see the ping request go through both igb1 and igb0, but I never get a response.
Things I can do:
+ ping the firewall box (as 192.168.2.1) from my local network
+ ping and access services in my local network from the firewall box
+ ping and access the internet from the firewall box
Things I can't do:
+ ping or access the internet from my local network (and probably vice-versa, but I'll worry about port forwarding at a later point)
Note the subnet 192.168.2.0/24 is assigned by the firewall's dhcpd:
- 192.168.2.1 is the firewall (gateway)
- 192.168.2.10 is the router
Below is every config file and command that I thought could possibly be relevant:
cat /etc/rc.conf:
Code:
clear_tmp_enable="YES"
syslogd_flags="-ss"
hostname="myfirewall"
# (ignore nfe0 interface for now - I have it link down for testing)
ifconfig_nfe0="ether [[redacted custom MAC address]] DHCP"
ifconfig_nfe0_ipv6="inet6 accept_rtadv"
gateway_enable="YES"
defaultrouter="[[redacted my ISP's gateway]]"
ifconfig_igb1="ether [[redacted custom MAC address] DHCP"
ifconfig_igb1_ipv6="inet6 accept_rtadv"
ifconfig_igb0="inet 192.168.2.1/24"
ifconfig_igb0_ipv6="inet6 accept_rtadv"
moused_nondefault_enable="NO"
dumpdev="AUTO"
kld_list="i915kms"
# PF is disabled until I figure this out
pf_enable="NO"
pf_rules="/etc/pf.conf"
pflog_enable=yes
ipv6_gateway_enable=yes
dhcpd_enable="YES"
dhcpd_ifaces="igb0"cat /etc/sysctl.conf:
Code:
security.bsd.unprivileged_read_msgbuf=0
security.bsd.unprivileged_proc_debug=0
kern.randompid=1cat /usr/local/etc/dhcpd.conf:
Code:
option domain-name "informants.nsa.gov";
option subnet-mask 255.255.255.0;
default-lease-time 600;
max-lease-time 7200;
subnet 192.168.2.0 netmask 255.255.255.0 {
range 192.168.2.10 192.168.2.100;
option routers 192.168.2.1;
option domain-name-servers 1.1.1.1, 8.8.8.8;
}netstat -rn:
(NOTE: I have replaced all mentions of my public IP below with "11.22.33.44", which turns my ISP subnet to "11.22.33.0/23" and ISP gateway to "11.22.33.1".)
Code:
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 11.22.33.1 UGS igb1
11.22.33.0/23 link#3 U igb1
11.22.33.44 link#4 UHS lo0
127.0.0.1 link#4 UH lo0
192.168.2.0/24 link#2 U igb0
192.168.2.1 link#4 UHS lo0
Internet6:
[[redacted because idgaf about ipv6]]ifconfig igb0:
Code:
igb0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=4e527bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
ether [[redacted MAC]]
inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
inet6 fe80::527c:6fff:fe52:ba28%igb0 prefixlen 64 scopeid 0x2
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>ifconfig igb1:
Code:
igb1: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=4e507bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
ether [[redacted MAC]]
hwaddr [[redacted MAC]]
inet [[redacted public IP]] netmask 0xfffffe00 broadcast 255.255.255.255
inet6 [[redacted ipv6]]%igb1 prefixlen 64 scopeid 0x3
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>edit: By the way, it's FreeBSD 14.1 x86_64
I guess that could be the part I'm missing. I already configured pf so I'm trying my luck with that first. I've enabled pf and rebooted the system to play around with NAT, but I didn't figure it out. The following line was the best I got: