Hi ANyone please need your help. My pbx on the same network with my public IP, works just fine. the problem only is my external pbx sees local IP to register per sip/extension, thats way it suddenly unreacheable which supposedly it will get the public IP of the PFSense. Please really need your help about this.

Yeah. What does a capture of the same traffic on pfSense LAN (or whatever inside interface the server is on) show? Check all of the things listed here as they generally apply to 1:1 as well as port forwards: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

Not sure if I did the right thing, but I got it working by adding these two floating rules [image: float.jpg] [image: float.jpg_thumb]

Ok good to hear about nothing close to having NAT issues.  I'll try capturing on the WAN interface and see what happens.  I sure wanted to put it on a 64 bit system but…the current hardware is so old lol...that's all it supported.  We haven't had any issues with it but have several of those machines left.  It's just hard at the moment with only being able to see what is going on via a remote webex session and the other end not being technical enough to assist.  I will try and see if I can get a capture of the WAN side tomorrow when we start another webex.

What is the IP address of your client? What is the IP address of your DNS server? You seem to have switched from natting to .254 to natting to .1. Port forwards translate the destination address. Outbound NAT translates the source address. You need to do both.

https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks NAT Reflection works for most people, but I much prefer to use split DNS.  Put an override on your DNS so that your domains resolve to their LAN IP addresses.  Problem solved with using a hairpin connection hack.

No fancy rules needed. All you have to do is add the network they asked for in the P2. Edit the Phase 2 entry for your tunnel and right under where you have 192.168.1.0 now, there's a box for NAT options, set it to the subnet they gave you (10.100.29.0/24). Then when your 1.x net tries to reach across the VPN, it looks like it comes from 10.100.29.x, and when the far side needs to reach your 1.x net, they talk to 10.100.29.x instead and the NAT will get it there.

Hi, Did you create a phase 2 for Othernetwork to 12.9?

You would craft a P2 for the IPSec tunnel to send your traffic from the local source to that remote IP address over IPsec, and then the far side firewall would perform outbound NAT there.

You don't use aliases, you use Virtual IPs. https://doc.pfsense.org/index.php/What_are_Virtual_IP_Addresses Once you have assigned your 5 IPs to your WAN, the net step is to create NAT rules that direct traffic from your public IP/port to LAN IP/port. https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

what device is it that does not allow you to set a gateway?  Doing a source nat is a work around, not the correct solution to the problem.  Your device is not meant to be used outside of its own layer 2 network for what reason?  What is the device?  Some wifi router your trying to use as AP?  If it supports putting 3rd party firmware on it like openwrt or dd-wrt, etc. this would allow you to set a gateway.

I figured its some corruption in the firmware - I used another machine and it worked great. Thanks for your help. I will close this case now

Im glad too :) I will take a look into the split dns also. It may be a bit more work since I dont use dns for all of my services but I can of course add host overrides to each one.

thanks for the tip I will try it with squid to see

yeah I think they only allow outgoing port 22 on my pc here, so I requested to open the other ports we'll see thanks anyways, If it is not solved that way, I'll come back :-)