use manual outbound NAT specifying the source IP/network you want to NAT.

Resolved, thank you very much for the idea, I put the PPPoE and pfsense as a bridge only modem briedg. 100% Valew.

@Brak:

If you use Firefox, install FoxyProxy addon, and set up a white-list filter for .youtube.com to go through the proxy. Not network wide, but achieves what you are looking for I think.

Xbox with XBMC doesn't have this option and some others, too, like my Android etc.  ;)
The other options are well known, but not the way to go.

You can actually enable loggin on the NAT rule.

Go into rules and find the rule you created and click the blue I.

If you then try and connect to it externally you can see in the system logs weather its being denied or allowed.

I had a problem almost simular to this, but its probably different. I used to have a watchguard being my Zyxel router, and i swapped the watchgaurd for a PFSense virtual machine. And when i forwarded some public ips to some natted nodes, it wouldnt work! all i had to do was turn off my Zxel and to flush out the cache and turn it back on again woolaaa! Good luck mate!

http://forum.pfsense.org/index.php/topic,47384.msg248969.html#msg248969  ;)

Will do, thanks for the tip :D I will post again in a few days if I figure out how to me it work!

have any like this issue.
such as other vm box system.

Read http://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks%3F

marcelloc is suggesting to use Method 2: Split DNS

Note that pfsense's "NAT Reflection" doesn't work for UDP (yet).

First package release is out.  :)

http://forum.pfsense.org/index.php/topic,47210.msg248054.html#msg248054

I did some changes to improve stability and checks for nanobsd or normal install.

@shon:

I was able to accomplish this but without having to select the "Manual Outbound NAT rule generation".  The rule was good enough to do the job.

Thanks!

thank you, I'll try the floating thing

Canefield,

It can be done in pfsense for sure. Haproxy will be easy to configure as it has few configure options and can do http as well https balance/failover.

Do not foget firewall rules to Allow traffic. ;)

Att,
Marcello Coutinho

Your rules appear to be correct. Are you using 1:1 NAT as well, or just port forward?

I move to GRE Tunnel over IPSEC.

Now i have one more interface on pfsense and i can ping remote side with it from GUI.
I left GRE Interface on "none", i add gateway for GRE and add a route for remote LAN Subnet.

From pfsense box 2 (192.168.201.222), i can ping my web server 192.168.1.6 and from pfsense box 1 (192.168.1.254), i can ping pfsense box 1 (192.168.201.222).
I can ping with GRE IP adress (172.31.2.10)

But from server behind pfsense, i can't ping remote side ?

It's a problem with outbound NAT may be ?

So any way to disable the timeout? I have Bacula server behind pfSense and all the backups (which could very well take even weeks) time out after 2000 seconds when port reflection is used.

In a rather old thread http://forum.pfsense.org/index.php/topic,1528.15.html I read that timeout should be set to 0 in order to disable it. I did it, but it does not seem to have any effect.