implement pfsense firewall routing

Author: mahauber

modules/connectivity-regional/2-network.tf

@@ -2,51 +2,36 @@
 ## NETWORKS ##
 ##############
 
-# will get auto assigned a free range from the network area (needs to be, because for a public ip it needs to be routed)
-resource "stackit_network" "wan" {
+# will get auto assigned a free range from the network area 
+resource "stackit_network" "hub" {
   project_id = stackit_resourcemanager_project.this.project_id
-  name       = "wan"
-  #ipv4_nameservers = ["208.67.222.222", "9.9.9.9"] provider bug
-  routed = true
-
-  depends_on = [stackit_network.lan]
-}
-
-# this is not used, because it is not routed (not reachable by other projects)
-# the wan interface actually handles the internal and external traffic
-# actually lan should be reachable internally and wan not
-resource "stackit_network" "lan" {
-  project_id       = stackit_resourcemanager_project.this.project_id
-  name             = "lan"
-  ipv4_nameservers = ["208.67.222.222", "9.9.9.9"]
-  ipv4_prefix      = var.vnet_range
-  ipv4_gateway     = var.firewall_ip
-  routed           = false
+  name       = "hub_network"
+  routed     = true
 }
 
 ################
 ## INTERFACES ##
 ################
 
-# the firewall will see a private ip, because stackit handles NAT (public ip is not attached directly)
 resource "stackit_network_interface" "wan" {
+  name       = "vtnet0_wan"
   project_id = stackit_resourcemanager_project.this.project_id
-  network_id = stackit_network.wan.network_id
+  network_id = stackit_network.hub.network_id
   security   = false
 }
 
 resource "stackit_network_interface" "lan" {
+  name       = "vtnet1_lan"
   project_id = stackit_resourcemanager_project.this.project_id
-  network_id = stackit_network.lan.network_id
-  ipv4       = var.firewall_ip
+  network_id = stackit_network.hub.network_id
   security   = false
 }
 
 ###############
 ## PUBLIC IP ##
 ###############
 
-resource "stackit_public_ip" "wan" {
+resource "stackit_public_ip" "wan-ip" {
   project_id           = stackit_resourcemanager_project.this.project_id
   network_interface_id = stackit_network_interface.wan.network_interface_id
 }

modules/connectivity-regional/3-firewall.tf

@@ -12,7 +12,7 @@
 #   }
 # }
 
-resource "stackit_image" "pfsense" {
+resource "stackit_image" "pfsense_image" {
   project_id      = stackit_resourcemanager_project.this.project_id
   name            = "pfsense-2.7.2-amd64-image"
   local_file_path = "./pfsense.qcow2"
@@ -23,21 +23,21 @@ resource "stackit_image" "pfsense" {
     uefi = false
   }
 
-  # depends_on = [terraform_data.pfsense_image_file]
+  # depends_on      = [terraform_data.pfsense_image_file]
 }
 
 ############
 ## VOLUME ##
 ############
 
-resource "stackit_volume" "pfsense" {
+resource "stackit_volume" "pfsense_vol" {
   project_id        = stackit_resourcemanager_project.this.project_id
   name              = "pfsense-2.7.2-root"
   availability_zone = var.firewall_zone
   size              = 16
   performance_class = "storage_premium_perf4"
   source = {
-    id   = stackit_image.pfsense.image_id
+    id   = stackit_image.pfsense_image.image_id
     type = "image"
   }
 }
@@ -47,16 +47,16 @@ resource "stackit_volume" "pfsense" {
 ############
 
 # after rollout: https://docs.stackit.cloud/products/quick-deployments/pfsense-firewall/tutorials/configure-pfsense/
-resource "stackit_server" "pfsense" {
+resource "stackit_server" "pfsense_Server" {
   project_id = stackit_resourcemanager_project.this.project_id
   name       = "pfSense"
   boot_volume = {
     source_type = "volume"
-    source_id   = stackit_volume.pfsense.volume_id
+    source_id   = stackit_volume.pfsense_vol.volume_id
   }
   availability_zone = var.firewall_zone
   machine_type      = var.firewall_flavor
-
+  
   network_interfaces = [
     stackit_network_interface.wan.network_interface_id, # vtnet0 = WAN
     stackit_network_interface.lan.network_interface_id  # vtnet1 = LAN

modules/connectivity-regional/4-routes.tf

@@ -2,17 +2,23 @@
 ## NETWORK AREA ROUTES ##
 #########################
 
-# Default route: send all non-local traffic from the network area through pfSense
-# This enables project-to-internet and project-to-project routing via the firewall
-resource "stackit_network_area_route" "default" {
+resource "stackit_network_area_route" "rfc1918_10" {
   organization_id = var.organization_id
   network_area_id = var.network_area_id
-  destination = {
-    type  = "cidrv4"
-    value = "0.0.0.0/0"
-  }
-  next_hop = {
-    type  = "ipv4"
-    value = stackit_network_interface.wan.ipv4
-  }
+  destination = { type = "cidrv4", value = "10.0.0.0/8" }
+  next_hop    = { type = "ipv4",   value = stackit_network_interface.lan.ipv4 }
 }
+
+resource "stackit_network_area_route" "rfc1918_172" {
+  organization_id = var.organization_id
+  network_area_id = var.network_area_id
+  destination = { type = "cidrv4", value = "172.16.0.0/12" }
+  next_hop    = { type = "ipv4",   value = stackit_network_interface.lan.ipv4 }
+}
+
+resource "stackit_network_area_route" "rfc1918_192" {
+  organization_id = var.organization_id
+  network_area_id = var.network_area_id
+  destination = { type = "cidrv4", value = "192.168.0.0/16" }
+  next_hop    = { type = "ipv4",   value = stackit_network_interface.lan.ipv4 }
+}

modules/connectivity-regional/outputs.tf

@@ -1,10 +1,10 @@
-output "pfsense_public_ip" {
+output "firewall_public_ip" {
   description = "The public IP address of the pfSense firewall WAN interface."
-  value       = stackit_public_ip.wan.ip
+  value       = stackit_public_ip.wan-ip.ip
 }
 
-output "pfsense_wan_ip" {
-  description = "The internal network area IP of the pfSense WAN interface (used as next hop in routes)."
+output "firewall_next_hop_ip" {
+  description = "The IP address to be used as next hop for the default route in the landing zones (pfSense WAN IP)."
   value       = stackit_network_interface.wan.ipv4
 }