Skip to main content

How to Replace the OVHgateway with a Manageable VM

Stephanie R.
Updated

This guide will explain how to replace the outgoing internet gateway (OVHgateway) with another network operating system that will give you, in addition to internet access, the ability to configure NAT and VPN (IPsec or SSL VPN).

Requirements

  • One Nutanix cluster provided by OVHcloud
  • Access to the OVHcloud Control Panel
  • Access to your clusters via Prism Central

Instructions

The OVHgateway uses two network cards by default:

  • One on VLAN 0 (base) connected to the internet with an additional OVHcloud IP address.
  • One on VLAN 1 (infra) connected to the local administration network with a range of IP addresses, in this example in 192.168.10.0/24.

In our guide, we will replace this gateway with the network operating system pfSense Community edition without software support.

NOTE: It is entirely possible to use this guide to install other network operating systems compatible with AHV.

Downloading sources for pfSense installation

Download an ISO image for the pfSense installation from this link: Downloading pfSense.

Using this documentation, add the pfSense ISO image to your Nutanix cluster.

Creating the GW-PFSENSE virtual machine

Create a virtual machine with these settings:

  • Name: GW-PFSENSE
  • Storage1: 100 GB HDD
  • Storage2: DVD drive connected to the pfSense ISO file
  • RAM: 4 GB
  • CPU: 2 vCPU
  • Network: 2 network cards, one on VLAN 0 (base) and the other on VLAN 1 (infra)

You can use our guide on virtual machine management to create this virtual machine.

gatewayVM01.png

 

Shutting down the OVH-GATEWAY virtual machine

To avoid duplicate IP addresses on the network, stop the OVHgateway virtual machine before starting the new virtual machine on pfSense.

Via Prism Central, click in the top left on the main menu.

gatewayVM02.png

 

Click VMs.

gatewayVM03.png

 

Click on the OVHgateway virtual machine.

gatewayVM04.png

 

From the More menu at the top, click Guest Shutdown.

gatewayVM05*.png

 

Retrieving the public address in the OVHcloud Control Panel

Retrieve information about the OVHcloud gateway network settings.

Log in to the OVHcloud Control Panel, select your Nutanix cluster, and find the information in the IPFO field.

gatewayVM06.png

IPFO is a range of four addresses. The first and last are reserved, the third is on OVHcloud hardware and serves as an Internet gateway. The only usable IP address is the second address in the range.

During installation, we will reuse this information to assign it to the new GW-PFSENSE virtual machine.

XX.XX.XX.N Reserved network address that appears on the OVHcloud client site
XX.XX.XX.N+1 IP address to be assigned to the GW-PFSENSE virtual machine WAN interface
XX.XX.XX.N+2 Address to be used as a gateway on the GW-PFSENSE VM WAN interface
XX.XX.XX.N+3 Reserved broadcast IP address

For example, if the IPFO address displayed on the client site is 198.51.100.0/30, use:

  • 198.51.100.1 for the WAN interface address.
  • 198.51.100.2 for the gateway on the WAN interface.

Start the GW-PFSENSE virtual machine

Go back to virtual machine management in Prism Central and click on GW-PFSENSE.

gatewayVM07.png

 

Select Power On from the More menu.

gatewayVM08.png

 

Click Launch console.

gatewayVM09.png

Installing pfSense

Review the pfSense license information and press the Enter key to accept it.

gatewayVM10.png

 

Choose Install, switch to OK with the Tab key, and press Enter.

gatewayVM11.png

 

Select Continue with default keymap, go to Select with the Tab key, and press the Enter key.

gatewayVM12.png

 

Select Auto (ZFS), switch to OK with the Tab key, and then press the Enter key.

gatewayVM13.png

 

Go to Select with the Tab key and press Enter.

gatewayVM14.png

 

Select Stripe, switch to OK with the Tab key, and then press Enter.

gatewayVM15.png

 

Select NUTANIX VDISK with the Space bar. Then go to OK with the Tab key and press Enter.

gatewayVM16.png

 

Go to YES with the Tab key and press the Enter key.

gatewayVM17.png

 

Choose NO with the Tab key and press the Enter key.

gatewayVM18.png

 

Select Reboot and press the Enter key.

gatewayVM19.png

Eject the pfSense CDROM from the GW-PFSENSE virtual machine

From Prism Central, go back to GW-PFSENSE virtual machine management and perform the following steps to eject the CDROM.

Click on Soft Shutdown in the More menu on the GW-PFSENSE virtual machine to stop this virtual machine.

gatewayVM20.png

 

Click Update.

gatewayVM21.png

 

Click Next.

gatewayVM22.png

 

Click the Eject icon next to the CDROM.

gatewayVM23.png

 

Click Next.

gatewayVM24.png

 

Click Next.

gatewayVM25.png

 

Click Save.

gatewayVM26.png

 

Click Power On in the More menu.

gatewayVM27.png

 

Click Launch Console to continue the installation after startup.

gatewayVM28.png

Configure pfSense IP addresses through the console

We will configure the pfSense gateway IP addresses as follows:

  • WAN interface: Use this part of the Retrieving a public address in the OVHcloud Control Panel guide to assign the IP address and gateway on this interface.
  • LAN Interface: 192.168.10.254/24 which is the gateway address of the Nutanix cluster private network followed by the subnet mask.

Accept the license by pressing the Enter key.

gatewayVM30.png

 

Type n and press the Enter key when asked if you need VLANs.

gatewayVM31.png

 

Type vtnet0 as the interface name for the WAN and press Enter.

gatewayVM32.png

 

Type vtnet1 as the interface name for the LAN and press Enter.

gatewayVM33.png

 

Confirm the changes by entering y, then press the Enter key.

gatewayVM34.png

 

Type 2 to choose Set interface(s) IP address and press Enter.

gatewayVM35.png

 

Select the WAN interface by typing 1 and pressing Enter.

gatewayVM36.png

 

Type n and press Enter when prompted to configure the address by DHCP.

gatewayVM37.png

 

Type the public IP address with the mask and press the Enter key, for example, 198.51.100.1/30.

Then enter the public gateway IP address and press the Enter key, for example, 198.51.100.2.

gatewayVM38.png

 

Type n and press the Enter key when the wizard offers you the configuration of the IPv6 address WAN interface via DHCP6.

gatewayVM39.png

 

When requested to revert to HTTP as the webConfigurator protocol, type n and press Enter.

gatewayVM40.png

 

Press Enter to validate the registration of the IP address of the WAN.

gatewayVM41.png

 

Type 2 and press the Enter key to configure IP addresses.

gatewayVM42.png

 

Take option 2 and press the Enter key to change the LAN IP address.

gatewayVM43.png

 

Type the private IP address followed by the mask 192.168.10.254/24 and press the Enter key.

gatewayVM44.png

 

Press the Enter key to not put a gateway on the LAN interface.

gatewayVM45.png

 

Press the Enter key to disable IPv6 usage.

gatewayVM46.png

 

Type n and press the Enter key on the DHCP server activation request.

gatewayVM47.png

 

Answer n and press the Enter key when prompted to revert to HTTP as the webConfigurator protocol.

gatewayVM48.png

 

You can now manage the HTTPS gateway on the private network of the Nutanix cluster.

Press the Enter key to complete the command line configuration.

gatewayVM49.png

Configure some options through the web interface

Connect to the pfSense Web Console with the URL https://192.168.10.254 from a cluster virtual machine on the AHV LAN: Base.

Enter the following information:

  • User account: admin
  • Default password: pfsense

Then click SIGN IN.

gatewayVM50.png

Change the pfSense default password**

From the System menu, choose User Manager.

gatewayVM51.png

 

Click the Pen icon.

gatewayVM52.png

 

Enter and confirm the password to the right of Password.

gatewayVM53.png

 

Confirm the changes by clicking Save at the bottom of the menu.

gatewayVM54.png

Add a rule to allow remote administration from a public address

Go to the Firewall menu and choose Rules.

gatewayVM55.png

 

Check that you are on the WAN tab, then click the Add button (at the bottom with the up arrow) to create a firewall rule.

gatewayVM56.png

Set these options in the Edit Firewall Rule section:

  • Action: Pass
  • Interface: WAN
  • Address Family: IPv4
  • Protocol: TCP

Select Single host or alias from the Source drop-down menu and enter the public address that can connect to the pfSense firewall.

gatewayVM57.png

Then set these options in the Destination section:

  • Destination: WAN address
  • Destination Port Range From: HTTPS
  • Destination Port Range To: HTTPS

Click Save.

gatewayVM58.png

 

Click Apply Changes to activate the rule.

gatewayVM59.png

 

The pfSense administration interface is then accessible from the Internet, only from the authorized network in HTTPS, here https://198.51.100.1.

Configuring Internet Access in a New VLAN

We will create a new subnet in VLAN 2 with an address range in 192.168.2.0/24 and a gateway in 192.168.2.254.

PfSense VM modification

Log in to Prism Central to make these changes:

Use the Isolating management machines from production guide to create a new VLAN on your Nutanix cluster with these settings:

  • VLAN name: Production
  • VLAN number: 2

Your new network must appear in Subnets.

gatewayVM60.png

 

Now that the new subnet has been created, we will add an adapter to the configuration of your GW-PFSENSE virtual machine.

Via the virtual machine management, select your GW-PFSENSE virtual machine, go to the Actions menu, and choose Update.

gatewayVM61.png

 

Click Next.

gatewayVM62.png

 

Click Attach to Subnet.

gatewayVM63.png

 

Choose the Production subnets and click Save.

gatewayVM64.png

 

Click Next.

gatewayVM65.png

 

Click Next.

gatewayVM66.png

 

Click Save.

gatewayVM67.png

 

Enable and configure the new network adapter on pfSense

Log in to the pfSense interface in https, with the public address (for example, https://198.51.100.1) in your pfSense administration interface, and follow these instructions:

Go to the Interfaces menu and click Assignments.

gatewayVM68.png

 

Click + Add to the right of Available network ports.

gatewayVM69.png

 

Click Save.

gatewayVM70.png

 

In the Interfaces menu, click OPT1.

gatewayVM71.png

 

Check Enable Interfaces and modify these settings :

  • Description: VLAN2
  • IPv4 Address : 192.168.2.254/24

Click Save.

gatewayVM72.png

 

Click Apply Changes.

gatewayVM73.png

 

Go to the Firewall menu and click Rules.

gatewayVM74.png

 

Go to the VLAN2 tab and click the Add button on the left.

gatewayVM75.png

 

Change these values :

  • Protocol: Any
  • Source : VLAN2 net
  • Destination: any

Click Save.

gatewayVM76.png

 

Click Apply Changes.

gatewayVM77.png

Your VLAN 2 is now connected to the Internet.

Go further

For more information and tutorials, please see our other Nutanix support guides or explore the guides for other OVHcloud products and services.

Related articles