PFSense is simply ignoring it!?!

No, pfSense is doing what it is being told to do which is apparently incorrect. Or some other issue is keeping it from working. See the above troubleshooting document for a pretty comprehensive list of things to check. And don't just skim them. actually check them all.

@johnpoz:

Did you forward the ports from the nat router in front of pfsense?  Pfsense can not forward something that never gets to it..

If you can not figure what your doing wrong - look over the troubleshooting doc..
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

If your trying to simulate coming from the internet by coming from the wan that is rfc1918.. Your going to have to make sure your uncheck block rfc1918 on the wan interface..

OK I will try it

Here it goes my working Outbound NAT from LAN to LAN:

0_1531410240204_transferir.png

Thanks ill take a look!

Either they havnt done it, just said they have. Or something is still wrong. Cause the issue remains.

No there is no reason for 2nd pfsense.. Just connect your 2nd wan to the 1st pfsense via a vlan on the wan interface..

@Derelict:

Port forwards translate the destination address and/or port.

Outbound NAT translates the source address and/or port.

It helped me to realize that "Outbound NAT determines how traffic leaving a pfSense system will be translated". That is, "outbound" from the pfSense system - not necessarily "outbound from the network". One can apply Outbound NAT rules to traffic that is "inbound" to the network (including Port Forward traffic).

The primary address is assigned using a PPPoE connection, the other addresses are a block assigned on that subnet. If I setup OpenVPN on the primary, perfect, no issues. If I try and use one of the other addresses, they are VIP's then no go, won't work.

Now, I have see other references to this issue on the forum where the solution is to use localhost, assign the VPN to that. Doing that alone still did not work, assigning the VIP to localhost AND assigning OpenVPN to that DOES work.

OK, port forward works nicely, replaced the 1:1 rule with that.

Edit: Port forward does NOT work, I obviously did not wait long enough for the rules to reload. Setting it back to 1:1 and removing the port forward it's working again.

My guess is this is not a NAT problem but that you may need some incoming firewall rules from your provider to your ATA lan address..

anyone ?

Thank you very much, that was indeed the problem. I thought in the wrong direction, the port on the firewalls side can of course be random as long as on the remote side it hits the 80 / 443.

"For now I don't care if someone see the cameras."

Its not that they can see the video..  Its that they can take control of the device and use it to access the rest of your network and or have the device attack other devices..

Its something you really should be concerned with.. if your users can click an icon on their phones - they can be setup to vpn into your network and be secure.

https://threatpost.com/hundreds-of-thousands-of-vulnerable-ip-cameras-easy-target-for-botnet-researcher-says/124192/
https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#backdoor-account

"It affects 1250+ camera models."

Could you elaborate, I have a similar problem in which some users should surf (80,443) on a second external IP. But 1:1 Nat seems overkill for me here.

edit: Hi my problem was defining a NAT Port that I shouldn't have done, now it works perfect:

http://i.imgur.com/2W7rwyz.png

62.X.X.X is my desired outbound IP that is defined as virtual IP -> IP alias for that one client and port.

could be it ? Because I was trying to access through my external IP.  Does reflexion matter on that scenario? Anyway when I get home I try it out thank you!

Was is running dhcp??  Did it have the same IP as pfsense?  How exactly what it connected in your network?

I think that you have the same problem that me.

https://forum.pfsense.org/index.php?topic=127882.0

Can you find a solution?