Pfsense on Xenserver between modem and WIFI router

Question

Im trying to set up pfsense at home. I have spent several hours setting this up but it is going nowhere . here is what I want to achieve: I have pfsense vm running.

Internet --> cable modem --> xenserver running pfsense vm--> wifi router(AP) for other devices. PFsense should have DHCP enabled for all the public facing websites/server vms.

WIFI router should have DHCP enabled. I dont mind if wifi router is not behind pfsense unless that could be achieved too

I tried to bridge WAN with OPT1. I dont think it is working as needed.

Im new to advanced networking and pfsense. I would really appreciate if someone could give me some direction. More descriptive would be better.

Here are my interface names and the configs/associations:

WAN is where my modem is connected where I have dynamic IP

WAN -> xn0 LAN -> xn1 OPT1 -> xn2 OPT2 -> xn3

Please let me know how to proceed!

Answer 1

I don't know why do you want a bridge mode. If you have single public IP then I suggest you to use schema below.

On pfSense set NAT rules (that also automatically will create firewall rules) to forward publicly accessible ports to OPT1 network where you public services work in VM. I'm not sure why do you want DHCP on OPT1, but it is OK to have it as far as you use static DHCP that would glue MAC addresses of VMs to particular IP. This way NAT will always forward incoming connections to particular VM.

In firewall rules enable passing all protocols from LAN to OPT1. This way internal LAN network would be able to access VM services but it will be protected from internet and OPT1 (so in case if some VM hacked, it will not be able to access LAN)

In pfSense DNS forwarder override public DNS records for FQDN of VMs, so when there would be connection from LAN to OPT1 it would point to VM located in OPT1 network.

For example, you have public A DNS record for web site that resolved to you public IP address as my.www.example.com->1.2.3.4
In DNS forwarder override public IP by setting my.www.example.com->10.1.10.50
This way if connection to VM comming from internet it will be passed over NAT to VM in OPT1 network, but if connection coming from LAN, pfSense's DNS forwarder will point to VM in OPT1 using private IPs.

As about WiFi, - use it as access point (AP). Leave WAN port disconnected, and set WiFi's LAN ip such way it will be in pfSense LAN range and disable DHCP on it. This way computers connected to WiFi LAN's port(it will work as regular switch) and WiFi clients will obtain IP from pfSense's DHCP.