NAT

• X

  Wireless Access Point and VLANs
  • xvalentinex  

  4
  0
  Votes
  4
  Posts
  5803
  Views

  J

  I did setup something similar using 3com APs and all is still working perfectly. What I did is : Vlan conf on NIC rl1: SSID 1: Vlan 4 SSID 2: Vlan 5 APs conf: APs mapping each SSID on the correct Vlan, Administration of the APs enabled for wired access only, no vlan on the "admin" link. Network interface on pfSense: RL1 : 172.16.1.0/24   network for monitoring the APs so each AP got an ip in this range RL1/VLAN4 : 172.16.2.0/24 network for first SSID, the public one unencrypted and broadcasted(DHCP and captive portal enabled, limited traffic by firewall rules) RL1/VLAN5 : 172.16.3.0/24 network for the second SSID, the private one that is encrypted (WPA2 PSK AES) and not broadcasted (DHCP enabled, all trafic alowed) So I've got a network for the APs themselves, usefull for monitoring it ;-) and two other networks for each SSID. Firewall rules prevent public traffic from going to private networks.
• D

  Help with NAT
  • dmconde  

  2
  0
  Votes
  2
  Posts
  2013
  Views

  H

  As your WAN is a private IP-Adressrange make sure "block private IPs at WAN" at interfaces>WAN is unchecked (it's enabled by default). In case your firwallrule was autocreated when adding the NAT i doubt that the problem is at the pfSense end. You might want to add a "log" for the rule that covers this NAT. You should see a pass event at system>systemlogs, firewall logs when trying to establish the connection. If that doesn'T happen it most probably gets stuck in the router in front of the pfSense.
• K

  "NAT Bouncing" UDP
  • KWolf  

  7
  0
  Votes
  7
  Posts
  4789
  Views

  H

  Just for fun, does it make a difference if you create the NAT and firewallrule to allow tcp and udp for this port? How do the nat reflection rules in /tmp/rules.debug look like?
• D

  Nat + Firewall
  • dax  

  2
  0
  Votes
  2
  Posts
  1839
  Views

  H

  Make sure you have entered some dns servers at system>general (if you WAN is not DHCP or PPPoE). Nothing to do next. LAn clients are now able to go to the internet and everything incominng at wan is blocked by default. Everything else depends on what you want to do but you already have basic connectivity.
• U

  Nat/port forwarding: big help pls
  • ugur  

  13
  0
  Votes
  13
  Posts
  6014
  Views

  U

  thnx for all :|
• J

  Questions about nat/port forwarding
  • Juve  

  6
  0
  Votes
  6
  Posts
  3199
  Views

  H

  Maybe a 1.1 feature, but don't take this as a promise. However (like always) patches accepted.
• D

  Nat from Lan to OPT1?
  • dag  

  3
  0
  Votes
  3
  Posts
  1761
  Views

  D

  Thanks for the fast response. I believe it's involving Rendezvous/Bonjour, which looks like it can work with multiple subnets, but not without some DNS wizardry… I'm not sure Tivo would be able to use PTPP, so I'm guessing I'll have to either bridge or rethink things. :/
• C

  How to get access to FTP from internet?
  • cluka23  

  4
  0
  Votes
  4
  Posts
  2336
  Views

  H

  The ftphelper is a proxy server that opens up dynamically firewall ports by investigating the control connection of the ftp session when a client and the server communicates. it lives at the firewall itself, so traffic to this destination has to be allowed too. If it wasn't there you had to port forward the additional portrange your server is using and/or use passive/active mode for your connections.
• G

  Whay ???
  • gurree  

  6
  0
  Votes
  6
  Posts
  2388
  Views

  H

  That's pretty simple and I use exactly the same setup at the office even with multiwan: 1. Delete everything you tried to get this connection going as it apperently doesn't work. 2. At system>advanced uncheck "disable nat reflection" at the bottom and save (this will make your public IP portforward available for the internal lan clients) 3. At firewall>nat hit the [+] Icon and add a portforward for   Interface: WAN,   external adress: interface Interface,   protocol: tcp   External Port Range: HTTP - <empty>,   NAT IP: <local ip="" of="" the="" server="" in="" dmz="">local Port: HTTP Auto-add a firewall rule to permit traffic through this NAT rule 4. Save and apply It should work now.</local></empty>
• C

  1:1 NAT MEGAWOES!
  • cheech  

  7
  0
  Votes
  7
  Posts
  3346
  Views

  C

  Wont allow me to specify this mask unless I also set my WAN IP to this and I am guessing I will have 0 connectivity at all then?
• B

  How should i NAT this?
  • barcode  

  3
  0
  Votes
  3
  Posts
  2153
  Views

  B

  ;D yes, that does the trick!! thaaanx…
• S

  Kamdelia network status firewalled
  • Switch  

  9
  0
  Votes
  9
  Posts
  5554
  Views

  S

  Ok, found the explanation to "solved button" http://forum.pfsense.org/index.php?topic=656.0.
• S

  Ftp server problem
  • Speck  

  25
  0
  Votes
  25
  Posts
  16939
  Views

  S

  Also make sure you are not blocking bogons. Finally check out http://faq.pfsense.com/index.php?sid=64164&lang=en&action=search
• G

  NAT with CARP
  • geeko71  

  7
  0
  Votes
  7
  Posts
  3364
  Views

  G

  Great !! THX 4 help will continue on the german forum ;-) cheers
• C

  Audiocodes … 1:1 NAT best choice?
  • cheech  

  4
  0
  Votes
  4
  Posts
  3068
  Views

  H

  The easiest (and imo best way too) is to add a hosts alias with the IP adresses of the local audiocodes. Then enter this alias in the red field when running the wizard where it asks for VoIP. Calculate the maximum bandwidth your voipchannels could use (for example 4 channels at g711 is about 4*90kbit/s) and set this in the bandwidth dropdown at the VoIP wizard screen.
• N

  NAT for VOIP phone
  • nsumner  

  7
  0
  Votes
  7
  Posts
  3310
  Views

  

  As it may cover the topic, I had problems with my old router and VoIP (United Internet), too. Problem was outgoing conections on random ports. But with pfSense and static port option in NAT, the problem disappeard automagically. The only thing you need is the one NAT rule mentioned and thats it. No Problems here anymore. Without any other software as e.g. the already mentioned proxies, you'll have to use a NAT rule. Grey
• P

  Disable NAT bug
  • pcatiprodotnet  

  2
  0
  Votes
  2
  Posts
  1558
  Views

  S

  This was fixed just a few days ago.  cvs_sync.sh releng_1 if you have a full installation.
• M

  Portforwaring, Port is fortwarded, but not open. (µTorrent)
  • McMoj  

  5
  0
  Votes
  5
  Posts
  3042
  Views

  M

  @hoba: Disable the outpost to see if it's causing the issue. What kind of WAN do you have? PPPoE? Other router in front of you? … I tried to disable outpost now, and it was closed anyway! I don't know if i have PPPoE (i have adsl2 from Bredbandsbolaget) I dont have any more routers, the pfSense is in the modem directly. In my old router (Netgear WGR614v6) it's work to have open ports. So i think it is the firewall in pfSense?
• D

  Outbound PPTP failing after advanced configuration
  • darrendavid  

  4
  0
  Votes
  4
  Posts
  3290
  Views

  D

  ah ha! changed the rule to GRE and we're good to go! cheers, darren
• D

  Portforwarding SSH/HTTP on BETA4 not working (for me, at least)
  • darrendavid  

  4
  0
  Votes
  4
  Posts
  2231
  Views

  H

  http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-routing.html
• D

  Beta4 NAT 1:1
  • dplamb  

  9
  0
  Votes
  9
  Posts
  3936
  Views

  H

  Cool, bump the green button if your issues are solved  ;D
• M

  Windows Shares dropping
  • mpitcavage  

  4
  0
  Votes
  4
  Posts
  2445
  Views

  M

  Ha! Thanks to you another quick ggogle gave me: http://unix.derkeiler.com/Mailing-Lists/FreeBSD/net/2005-07/0173.html "Since windows sharing is generally a two way protocol you might find it a little hard to work with NAT. The name resolution is one thing and the RPC based authentication is another. " Thanks, it's great to have a clear answer.  I'm going to try that VPN solution today.
• S

  Why isn't it possible to access NATed services by the public IP address from LAN
  • sniffer  

  24
  0
  Votes
  24
  Posts
  9876
  Views

  R

  @sullrich: @sniffer: @Sharaz: im not sure why you would access something that is already on your local lan, via its external ip address?  (well i guess other than for testing). 1-To test external DNS 2-To test some rules (The rule are not the same via the Lan NIC and the OPT1 NIC) But with proxy,  its possible to test it, but you have to search active proxy… Thanks all for your answer Has anyone stopped to think of the ramifications of this feature?  ALL traffic that would have been to the LAN would be sent THROUGH the firewall.  What good is that when you could simply run split dns and keep all traffic LOCAL? Split DNS is possible if you have multiple IPs. I only have 1 and multiple servers on a VMware Server box. This is my home network and don't have money to spend for multiple IPs. So theres no easy way to seperate traffic to the same hostname on different ports to different machines without this feature. Yes you can go directly to the machine name, but for mail its a pain to switch back and forth when your inside and outside the network. Same with web applications that have hard coded address (Gallery is just one of them).
• S

  Feature request: "Extended" Alias
  • Sateetje  

  2
  0
  Votes
  2
  Posts
  1716
  Views

  H

  There won't be any change on the aliassystem for pfSense 1.0, but pfSense 1.1 is already under developement. The aliassystem has much improved already in 1.1 and work on it has just started. It's too early to promise anything but we allready discussed something like that in the past. Stay tuned  ;)
• Z

  Gltich with NAT ports (ext. diff from int)
  • ZGamer  

  8
  0
  Votes
  8
  Posts
  3470
  Views

  S

  @ZGamer: The problem is that when it creates them that way they cancel out each other and the ports are not accessible from the outside. If you see a problem how about offering a patch?
• R

  Squid NAT Rule Same Interface
  • rsw686  

  2
  0
  Votes
  2
  Posts
  4510
  Views

  R

  I gave up getting it to work. What I did was set the dhcp server gateway in pfsense to point to the squid box. Then I just enabled ipv4 fowarding and created two iptables rules. Yes this puts all dhcp clients no matter what protocol or port through the squid box, but the performance hit is neglibile and will be outweighed by the caching effect. Especially for google maps and live.local virtual earth. All servers still point to the pfsense box as their default gateway. If anybody wants to duplicate … I'm running fedora core 4, squid setup in transparent proxy mode. Add/change the following line in /etc/sysctl.conf to enable ip forwarding. net.ipv4.ip_forward = 1 Then just add the following iptables rules to /etc/rc.local iptables -A FORWARD -j ACCEPT iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 The first rule says to accept and forward all traffic received to the default gateway (pfsense) otherwise aim, mail clients, etc wouldn't work. The second intercepts the http traffic and sends it to squid on the default port of 3128. I also use the following script so I can make changes to squid and restart it without end users seeing. echo "Stopping Squid Traffic Redireect" iptables -t nat -F PREROUTING service squid restart echo "Redirecting Traffic To Squid" iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 This just clears the iptables then reinstates the rule after squid restarts. You can make modifications of this to stop squid, etc.
• G

  Counter Strike:Source server invisible to internet.
  • Gitsum  

  5
  0
  Votes
  5
  Posts
  2818
  Views

  G

  Ok, I got it working again. After hours and hours of trying differnet things and then re-reading CAREFULLY the topic of static-routes, I seem to have success. I was trying to write a new outgoing NAT rule instead of just editing the default one that was already there. All I did was click the "Static Port" box. I'm going to get some sleep now. Maybe. :)
• M

  Error when using port aliases in NAT in Beta3
  • msamblanet  

  6
  0
  Votes
  6
  Posts
  2595
  Views

  M

  :-[ Well, I feel stupid now - entirely forgot about the view file feature - Thanks for pointing it out :-[
• T

  Private IP is not hiden
  • tripson  

  10
  0
  Votes
  10
  Posts
  3381
  Views

  T

  blah, silly me… :) thank you both, sullrich and cmb, for answers! have fun trip
• A

  Port forwarding gre
  • aldo  

  4
  0
  Votes
  4
  Posts
  3433
  Views

  B

  @aldo: when attempting to port forward the gre protocol it adds a port definition to the end of the rule with no port. thus the rule fails to load. Thanks, fixed in CVS, it should appear in RELENG_1 shortly –Bill
• E

  Strange problem with VoIP adapter
  • Erik  

  15
  0
  Votes
  15
  Posts
  17288
  Views

  E

  So, I finally managed to get time to look at the problem. I installed BETA2 (leaps and bounds better than BETA1 in almost every area, thanks everybody!), and I'm glad to say that the static-port did the trick. Quick summary: Enabled advanced outbound NAT, changed the default outbound rule to enable static-port. Reboot adapter. That's it! I'm not sure if I still need the following rules on the NAT: port forward page: WAN  UDP  5060 - 5061  192.168.0.9  5060 - 5061 WAN TCP/UDP 5004 192.168.0.9 5004 Will have to test that. Thanks to everybody who replied, end everyone who has worked so hard to make pfsense better! Erik
• A

  NAT Inbound redirects
  • aldo  

  3
  0
  Votes
  3
  Posts
  2510
  Views

  A

  ok but the host is external not internal. oh well it does not seem to create a problem
• T

  Port Forward + 1:1 NAT
  • tdickson  

  4
  0
  Votes
  4
  Posts
  2403
  Views

  T

  Thanks for the reply!  I will stand by in anticipation  ;D You guys are the best!
• N

  Can the firewall create NAT rules
  • nsumner  

  4
  0
  Votes
  4
  Posts
  2044
  Views

  H

  I added it to our "not ready yet but cool to have at some point" feature list. Stay tuned  ;)
• F

  What do I have to do to make my Bulletproof FTP client working?
  • Franky  

  4
  0
  Votes
  4
  Posts
  2193
  Views

  S

  If you are running on a full install issue the following from a shell prompt: cvs_sync.sh releng_1 && /etc/rc.filter_configure Then make sure the FTP helper is enabled for the interface in question (I am guessing LAN). Also, if you are using a dual wan, then FTP will not work on the 2nd WAN.q
• N

  Custom NAT?
  • Numbski  

  1
  0
  Votes
  1
  Posts
  1914
  Views

  No one has replied

• A

  NAT simply not working?
  • admiraldennis  

  5
  0
  Votes
  5
  Posts
  2877
  Views

  A

  @sullrich: Yes.   We are not geared for the same hardware. If we where, what would be the point of the fork? Makes sense, thanks again for the help. I'll swap the machine for a Pentium III with some decent amount of RAM and see if things improve.
• N

  Serious packet loss issues when 1:1 is enabled.
  • Numbski  

  7
  0
  Votes
  7
  Posts
  3554
  Views

  H

  We need to make our textx more interesting to ready, maybe some boops would help  ;D
• N

  Need a new option for "port forwards" re: XMLRPC sync.
  • Numbski  

  5
  0
  Votes
  5
  Posts
  2612
  Views

  N

  Just double checking this, and realized I never posted a link to the ticket: http://cvstrac.pfsense.com/tktview?tn=848
• P

  1:1 Nat reflection
  • PeterZ  

  3
  0
  Votes
  3
  Posts
  2751
  Views

  S

  And to quote from System -> Advanced: "Disables the automatic creation of NAT redirect rules for access to your public IP addresses from within your internal networks. Note: Reflection only works on port forward type items and does not work for large ranges > 500 ports."