Blad konfigu sieci dla pfSense na VM VB.

[Matrixx]

Zadanie dla dobrego sieciowca.
Chce odpalic "goscia" pfSense na VM VirtualBox dla ktorego hostem jest Debian Jessie.
Gdzies robie blad w konfigu sieci, pomozecie go znalezc?

My data:
- uname -a

Kod: Zaznacz cały

Linux debian8 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux

- dpkg -l | grep virtualbox

Kod: Zaznacz cały

ii  virtualbox-5.1                        5.1.14-112924~Debian~jessie          amd64        Oracle VM VirtualBox

- Downloaded and installed:

Kod: Zaznacz cały

pfSense-CE-2.3.3-RELEASE-amd64.iso
- Guests Additions
- Extensions.

- Architecture - lscpu

Kod: Zaznacz cały

Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                8
On-line CPU(s) list:   0-7
Thread(s) per core:    2
Core(s) per socket:    4
Socket(s):             1
NUMA node(s):          1
Vendor ID:             AuthenticAMD
CPU family:            21
Model:                 2
Model name:            AMD FX(tm)-8320 Eight-Core Processor
Stepping:              0
CPU MHz:               1400.000
CPU max MHz:           3500.0000
CPU min MHz:           1400.0000
BogoMIPS:              7023.81
Virtualization:        AMD-V
L1d cache:             16K
L1i cache:             64K
L2 cache:              2048K
L3 cache:              8192K
NUMA node0 CPU(s):     0-7

- Motherboard - dmidecode -t 2

Kod: Zaznacz cały

# dmidecode 2.12
SMBIOS 2.7 present.

Handle 0x0002, DMI type 2, 15 bytes
Base Board Information
	Manufacturer: ASUSTeK COMPUTER INC.
	Product Name: M5A99X EVO R2.0
	Version: Rev 1.xx
	Serial Number: 130511776701058
	Asset Tag: To be filled by O.E.M.
	Features:
		Board is a hosting board
		Board is replaceable
	Location In Chassis: To be filled by O.E.M.
	Chassis Handle: 0x0003
	Type: Motherboard
	Contained Object Handles: 0

- BIOS - dmidecode -t bios -q

Kod: Zaznacz cały

dmidecode -t bios -q
BIOS Information
	Vendor: American Megatrends Inc.
	Version: 1708
	Release Date: 04/10/2013
	Address: 0xF0000
	Runtime Size: 64 kB
	ROM Size: 8192 kB
	Characteristics:
		PCI is supported
		BIOS is upgradeable
		BIOS shadowing is allowed
		Boot from CD is supported
		Selectable boot is supported
		BIOS ROM is socketed
		EDD is supported
		5.25"/1.2 MB floppy services are supported (int 13h)
		3.5"/720 kB floppy services are supported (int 13h)
		3.5"/2.88 MB floppy services are supported (int 13h)
		Print screen service is supported (int 5h)
		8042 keyboard services are supported (int 9h)
		Serial services are supported (int 14h)
		Printer services are supported (int 17h)
		ACPI is supported
		USB legacy is supported
		BIOS boot specification is supported
		Targeted content distribution is supported
		UEFI is supported
	BIOS Revision: 4.6

- Virtualisation:
- Flags - svm.

Kod: Zaznacz cały

grep -E "(vmx|svm)" /proc/cpuinfo --color=always
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 popcnt aes xsave avx f16c lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb arat cpb hw_pstate npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold vmmcall bmi1

- AMD-v mode in UEFI BIOS – enabled.
- VB virtualisation - In VirtualBox click -> Settings -> System -> Acceleration enabled.
Networking: Standard ADSL connection with ISP modem.
1/ - Host

Kod: Zaznacz cały

- netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

- ifconfig -a
eth0      Link encap:Ethernet  HWaddr 60:a4:4c:64:a8:bd  
          inet addr:192.168.0.182  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: 2a02:8084:81:2980:62a4:4cff:fe64:a8bd/64 Scope:Global
          inet6 addr: fe80::62a4:4cff:fe64:a8bd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9120 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8267 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:5410974 (5.1 MiB)  TX bytes:1328897 (1.2 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:35 errors:0 dropped:0 overruns:0 frame:0
          TX packets:35 errors:0 dropped:0 overruns:0 carrier:0
              RX bytes:4613 (4.5 KiB)  TX bytes:4613 (4.5 KiB)

2 / - VB Virtual machine
- Networks:
- vboxnet0:
- Adapter, Ipv4 address: 192.168.56.1
Mask: 255.255.255.0
- DHCP server: 192.168.56.2
Mask: 255.255.255.0
Lower Address Bound: 192.168.56.21
Upper Addres Bound: 192.168.56.24
- Adapters:
;Adapter1,
- bridged adapter
- eth0
- Intel PRO/1000 MT Desktop (82540EM)
- Cable connected
- enabled.
;Adapter2,
- Host-only
- vboxnet0
- Intel PRO/1000 MT Desktop (82540EM)
- Cable connected
- enabled
3/- “Guest” pfSense.
- Assigned interfaces: Assigned IP address:
- WAN – em0 - v4/DHCP4 192.168.0.47/24
- LAN - em1 - (static) 192.168.56.1/24
- Ping google.ie. http://imgur.com/a/9tRxg
- Access webConfigurator: http://imgur.com/a/MSzvE
- Outcome: http://imgur.com/a/HqXLt

Co jest nie tak, dlaczego nie moge wejsc w webConfigurator?

[LordRuthwen]

A nie masz konfliktu 2 / - VB Virtual machine - Adapter, Ipv4 address: 192.168.56.1 z 3/- “Guest” pfSense. - LAN - em1 - (static) 192.168.56.1/24 ?
Poza tym jakiś routing do sieci 192.168.56.0/24?

[Matrixx]

A nie masz konfliktu 2 / - VB Virtual machine - Adapter, Ipv4 address: 192.168.56.1 z 3/- “Guest” pfSense. - LAN - em1 - (static) 192.168.56.1/24 ?

Zmienilem, ipaddress interfejsu vbox0 na 192.168.56.10 - nadal nie dziala.

Poza tym jakiś routing do sieci 192.168.56.0/24?[/quote
Tak to wyglada:

Kod: Zaznacz cały

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
192.168.56.0    *               255.255.255.0   U     0      0        0 vboxnet0

Kod: Zaznacz cały

ip route list
default via 192.168.0.1 dev eth0 
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.182 
192.168.56.0/24 dev vboxnet0  proto kernel  scope link  src 192.168.56.10 

Dziwne interfejsy:

Kod: Zaznacz cały

cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

[LordRuthwen]

Czekaj, bo czegoś nie czaję, jak one są połączone, możesz narysować? Będzie łatwiej.
Ale generalnie szukałbym tcpdumpem gdzie mi pakiet gubi na każdym hoście (w przypadku routera na obu interfejsach).

[Matrixx]

jak one są połączone, możesz narysować? Będzie łatwiej.

Niepieknie bo na szybko: http://imgur.com/a/5BpBu
Tak:

Networking: Standard ADSL connection with ISP modem

Na desktopie Jessie na Jessie VM VB na VM VB - pfSense.
Mam zainstalowanego tcpdump,a tylko nie cwiczonego.
Podaj komendy bedzie szybciej.

[LordRuthwen]

I zakładam, że chcesz się tam dostać z Jessie?
Na początek:
Jessie:

Kod: Zaznacz cały

ip r sh

VB:
Dlaczego hostonly?

Kod: Zaznacz cały

ip r sh

Coś mi się tu nie podoba.

[Matrixx]

Chce przepuscic caly traffic przez pfSense (firewall)
Przy takim zalozeniu caly ruch z Jessie (i ewentualnie innych "gosci" ktore zaloze) zanim opusci moj LAN musi byc przefiltrowany przez pfSense.

Kod: Zaznacz cały

ip r sh
default via 192.168.0.1 dev eth0 
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.182 
192.168.56.0/24 dev vboxnet0  proto kernel  scope link  src 192.168.56.10

Interfejsy:

Kod: Zaznacz cały

tcpdump -D
1.eth0 [Up, Running]
2.vboxnet0 [Up, Running]
3.any (Pseudo-device that captures on all interfaces) [Up, Running]
4.lo [Up, Running, Loopback]
5.nflog (Linux netfilter log (NFLOG) interface)
6.nfqueue (Linux netfilter queue (NFQUEUE) interface)
7.usbmon1 (USB bus number 1)
8.usbmon2 (USB bus number 2)
9.usbmon3 (USB bus number 3)
10.usbmon4 (USB bus number 4)
11.usbmon5 (USB bus number 5)
12.usbmon6 (USB bus number 6)
13.usbmon7 (USB bus number 7)
14.usbmon8 (USB bus number 8)
15.usbmon9 (USB bus number 9)
16.usbmon10 (USB bus number 10)
17.usbmon11 (USB bus number 11)

Poprawka: http://imgur.com/a/gd4lZ

[LordRuthwen]

jeszcze pokaż tablicę routingu VB - dla pewności

[LordRuthwen]

Tak działać nie będzie.
Masz adresację 192.168.0.0/24, za nią 192.168.56.0/24 i masz w niej hosta z tej pierwszej.
Jeżeli chcesz mieć pfsense w adresacji 192.168.0.0/24 to musisz zrobić sieć typu bridged zarówno na adapterze2 VB jak i na emX na pfsense.

[Matrixx]

Jaka komenda?
Podaje "route + vbox0 IP address" niestety nie dziala.