Ask Your Question

Problem using pfSense VM inside a tenant

asked 2014-04-10 07:36:09 -0500


i have done an experiment to create an image of pfSense ( ) that is used like a router in my tenant.

I've installed "virtio" driver on FreeBSD 8.3 for networking & disk support and image work perfectly.

I have a "demo" tenant with this network topology:

  • WAN: - DHCP Enabled - Gateway
  • LAN: - DHCP Enabled - No Gateway
  • Router with interface and connected to ext_net

Inside this tenant there are two VM:

  1. pfSense - An instance of pfSense that I use like a router with two network card (WAN: & LAN:
  2. cirros - An instance of Cirros connected with one network card to LAN

In cirros I've change default route to point to address so pfSense can route packet to WAN for me.

But routing doesn't work.

After a bit of testing, I realized that it's a problem with a DROP iptables rule, generated by agent on the hypervisor where VM runs, for protect by spoofing attack.

It's possible to disable/remove this rule for a single port with neutron API ?



edit retag flag offensive close merge delete

2 answers

Sort by ยป oldest newest most voted

answered 2014-06-16 07:27:19 -0500

Some weeks ago I have wrote an email to a Openstack user, Jose Castro, for having an opinion about my problem with pfSense and he found a solution.

You must add allowed_address_pairs to LAN pfsense port and everythingis working:

neutron port-update <LAN_pfsense_uuid> --allowed-address-pairs
type=dict list=true mac_address=<MAC_LAN_pfsense>,ip_address=

With this port extension, neutron create a iptables rule that allow packets to LAN pfsense from any IP and everything is working.

Very thanks to Jose for solution of the problem

edit flag offensive delete link more


You're welcome :)

jfcastroluis gravatar imagejfcastroluis ( 2014-06-20 16:14:15 -0500 )edit

answered 2014-05-29 02:31:02 -0500

thirunaresh gravatar image

Hi Salvo,

I am in the process of creating pfsense image for openstack. Since you have already done that. Help me on the process of creating image.

Thanks Naresh

edit flag offensive delete link more


sir yes sir

Xavier gravatar imageXavier ( 2014-06-30 05:45:15 -0500 )edit

hi, I'm always getting "/tmp/rules.debug:18: cannot define table bogons: Invalid argument" when I try to run PfSense inside an OpenStack VM. The instance boots correctly and configure its interfaces.. Can you help me?

d.carmignani gravatar imaged.carmignani ( 2017-07-18 10:28:37 -0500 )edit

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower


Asked: 2014-04-10 07:36:09 -0500

Seen: 6,540 times

Last updated: Jun 16 '14