• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Setting up m0n0wall inside VMWare Server

K

kodek64

n00b
Joined
Oct 26, 2007
Messages
35
Hey guys,

This is driving me crazy. I decided to move my m0n0wall router into a VM so I could get rid of a physical computer at home (thinking it would be relatively simple), but it's not as easy as I thought it'd be.

Right now I have my DSL modem hooked up to a physical NIC (eth1), which is bridged to vmnet1, and my LAN is hooked up to a different NIC (eth0), and bridged to vmnet0. I told m0n0wall which virtual interface is which, and now I have a "working" dhcp/nat server.

Here's the issues I'm trying to solve:

1. Since my WAN interface is bridged, both the guest and the host are grabbing different external IPs. This isn't a big deal, except for the fact that it adds unnecessary confusion whenever I have to troubleshoot something. I'd like the entire network to have one external IP and have everything else NATted to it.
2. m0n0wall is protecting my network just fine, but the host computer running it is wide open. Right now I have sshd and all the vmware services exposed to the outside world, which I really don't want. I know the solution is iptables, but I have zero experience with it. Any guidance would be appreciated :)
and finally,
3. For some reason, all the ports that are forwarded inside m0n0wall are still blocked somewhere in the network. I'm guessing the host is blocking them? I used the simple uTorrent port forward check, and it fails. I know m0n0wall is set up correctly because I based my config on a working one. This is the biggest problem I have right now that I'm trying to fix. Any hints?

So, basically, I'd like the host to be completely transparent right now. How can I achieve that?

Thanks in advance,

KodeK

EDIT: I think #3 was my stupid mistake. I forgot to renew my desktop's dhcp lease to match the IP to the one I had on the firewall. My desktop's connection dropped and as soon as it came back up, the port was "automatically" forwarded. Would this make sense? (Router checked lease, and since IP didn't match the reserved IP, it renewed the lease. Would it make my desktop drop all of its connections? If so, is this logged anywhere? I'm running Win7.)
 
Last edited:
Right now i`m running pfSense as VM on my ESXi box but in the past i used to have VMware Server with m0n0wall and a few others VM. the problem in #1 can be avoid configuring eth1 without TCP/IP stack on the host, this way the host will not get ip from the router. this was the way i do it in the past.

NOTE: i was using Windows 2003 Server as host.
 
That's genius! I'm going to figure out how to do that. Anyone know how to remove the tcp/ip stack in linux? :)

Edit: I set up my eth1 adapter to have a 10.0.0.1 address that would not conflict or communicate with anyone, and now everything works just fine. I couldnt just ifdown eth1, because the bridged adapter would go down too. Is this an okay solution, or am I asking for trouble?
 
Last edited:
As long as your incoming firewall rules block RFC 1918 (private ip networks) you should be fine, otherwise you could be exposed.
 
You must log in or register to reply here.
Back
Top