advanced outbound nat?

Search the forum for static port.

Search the forum for "static-port".

Assuming you put a NIC in the existing firewall and address it 10.10.1.254/21, connect it the new network. You would then go to system, static routes on the second box and add a route to 192.168.0.0/21 gateway 10.10.1.254. Then make sure firewall rules on both sides allow the traffic.

I'm interested in this too, I got two IP address, but the only way I can grab them is to use DHCP to grab them, so it would be great if there was a solution to this, at the moment I'm thinking of having two "Wan" port on the machine one to grab the first IP, then second one to grab the second IP, then do NAT on it.

@ppolymorphe: Hello, My LAN subnet is 192.168.1.0/24. for maintenance purpose I have to plug some modems on the 10.0.0.0/8 subnet. so I created a VLAN (OPT1) with LAN as parent and subnet 10.0.0.0/8 . What do I need to do to make LAN and OPT1 comunicate ? Thanks in advance Patrice All I did was copy the same rule by default for LAN to the OPT1 interface.  I thought there was an additional setting similar to say a Cisco PIX config but that was not the case. Joe

Thx a lot once again Perry, you made my day  ;D The real difficult thing was to add the firewall rule for the whole pool :)

@GruensFroeschli: maybe with the captiv portal? Yes, captive portal is nice solution. But which? It is very important that have setting: how often is user redirected (every 2-3 minutes, or every 10th page, …) Do you know any? Thanx for response.

Fixed, Thanks.

I have upgraded to the latest snapshot and so far so good. Been up for 3 days or so no problems.

Use Outbound NAT.

Yeah, you wouldn't need the port-forward if you didn't want to make any services on the box available via the outside. The gateway and outbound public would be handled via the firewall/NAT rules.

I haven't tried this myself, but I think that you can define VIPs for your publics, then select 'any' for the translate address in the outbound nat. Pf will allow using a table with various addresses for NAT (if you only wanted to use some of your vips), but I don't know of a way to configure that in the gui.

@sullrich: Use advanced outbound NAT to force the outgoing traffic from the internal IP to the correct CARP address. Unless you're using 1:1 NAT, in which case this should be done automatically.

I mean a firewall to do IPsec and another to do NAT, both at the same site. It would be a messy complicated setup (and I'm not totally sure it would be possible).

Filtered Bridge = enabled, pass all Traffic shaper = on Outbound NAT = on Rule NAT LAN    10.62.0.0/24  *  * 25  *  *  NO If i send Mail 1 .- one time no connection, but in quque shown qmailDown activity and Filter log Jun 14 22:24:13 router pf: 3\. 446895 rule 223.qmailDown.4/0(match): pass in on rl0: 10.62.0.30.3420 > 194.67.23.111.25: S 613257647:613257647(0) win 65535 Try and try new: 2 .-over time success send, but activity in def queue ??? Any idea?

where would I go to find the FTP proxy thats enabled?  why would this be a normal setup I would think you would want to tell where your FTP users are connecting from. :)  Thanks for your help. -edit I found it finally :)  Thanks for the help it show the correct IP now.