PF (the filter used by pfSense) scrambles ports for advanced security by default. Some VOIP-Providers don't like that. Have a look at the following links how to shut down this behaviour for your VOIP-Phone: http://forum.pfsense.org/index.php/topic,104.msg5876.html#msg5876 http://forum.pfsense.org/index.php/topic,1047.msg12752.html#msg12752 There are other threads covering this too. Search for "static port" if you still have questions.

Glad you got it working finally  :)

Try unchecking "block private IPs" at interfaces>wan.

You only create the portforward at wan so lan will be untouched. However if you want to make the webgui available at wan later you probably should use another port for it (and of course use https for it).

Scrambling ports is done as an extra security mechanism.

This is currently not supported.

use the cnet adsl router as a bridge ? .. I got a do not know, and its so hidden so i cant be cba to check it, but its set as bridge, so the pfsense get the wan adress directly. :) 82.xxx.xxx.68                  82.xxx.xxx.68                192.168.1.0/24 Adsl modem/router –--->  Pfsense  -------> Smc DT1024Ez------------> Wlan router as bridge                                           |                          24 Port switch-------> all other interfaces/comps/eq such as printers,computers, etc.                                           |---------------|                                         DMZ                  |                                       192.168.0.0/24      |--------Restricted User lan 192.168.1.0/24 with stronger rules than my normal lan                                       Cisco 800S                        Dlink managed 16 Port                                       4Port                                |                                       |                                    |                                       Windows server 2003--------- Okey, i know u wont have to have so damn advanced, but here can ya see some bridging rules, im gonna change the 192.168.1.0/24 restricted user lan adress and rules though. Well, use bridging, its kinda fun ;D instead of having vlan and such damn annoying extra things that can cause extra issues with applications or port forwarding..

Then your provider either uses a proxy to fix it at their end or uses IAX which is NATfriendly.

I experience the same issue with 1:1 NAT, regardless of whatever I try under pfsense 1.01.  Any ideas how I might go about troubleshooting this issue?

Thanks for favourable reply

Dropping the PIX setup is not an option. The PIX are already in a dual failover configuration, the support is paid up for this year, and migration and verification of the thousands of rules on the PIX to pfSense would take more time than I am willing to commit at this point. Is what I am trying to do with pfSense doable with the current version? If it works, it would be a great intermediate step. Thanks, Sean Harbour sharbour@nwresd.k12.or.us

That's right but it wouldn't help in this example as he changed protocols ;)

pfSense does NAT by default on any interface that has a gateway specified e.g. WAN or any OPT-Interface that has a gateway (and thus can be used as additional WAN). If you want to shut down this behaviour you can do so by enabling advanced outbound nat at firewall>nat, outbound tab and specify custom mappings.

There are some posts with screenshots around in this forum. Please search.

Try to add some advanced outbound "no nat" rules. Not ruse if this will work though or if they get "beaten" by the 1:1 nat's.

@Jakk: No, they do not NAT the traffic, it is only within the operators own network cloud where they use 172.x.y.z addresses as link addresses between different IP-routers. Just wondering, but it is your ISP Covad by any chance?  I have dealt with several Covad DSL setups where the WAN range from their side is a 172.x.x.x network, and the LAN range is your normally used public range. Thanks…

AHHHH DUH obviously I would first have to ckeck the desired rule(s) then click the x "delete" icon at the very bottom of the list.  Too bad it is not set up like firewall rules. Thanks