Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT Outbound not working between VLANs

    Scheduled Pinned Locked Moved NAT
    outbound nat
    28 Posts 2 Posters 3.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      idan37s @johnpoz
      last edited by idan37s

      @johnpoz

      I have DNSBL (unbound mode), GeoIP block (inbound) and IP block (inbound and outbound) all enabled in PfBlockerNG.
      The GeoIP and IP Block are creating Floating Rules in the FW on the WAN interface (as seen in one of the screenshot above).

      • When PfBlockerNG itself is enabled, then new rules I add in NAT Outbound do not show up in the list I get from the command "pfctl -sn", and those new rules don't work.
      • Once I disable PfBlockerNG (and doing only that, nothing else) the new NAT Outbound rules I added now show up in the list form the command, and they do work.
      • I can now re-enable PfBlockerNG and the new rules will still be in the list from the command and everything will work as expected.

      So as you said, it seems like PfBlockerNG is preventing an update on those rules list or something like that.

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @idan37s
        last edited by

        @idan37s turn off just the dnsbl stuff and or the firewall aspect, and leave pfblocker enabled.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        I 1 Reply Last reply Reply Quote 0
        • I
          idan37s @johnpoz
          last edited by

          @johnpoz

          I tried that,
          I disabled DNSBL, IP Block, Disabled all the FW Floating Rules,
          But the NAT Outbound rules still didn't work.

          Only disabling the PfBlockerNG itself made it work.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @idan37s
            last edited by

            @idan37s said in NAT Outbound not working between VLANs:

            Disabled all the FW Floating Rules,

            You did that here?

            both.jpg

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            I 1 Reply Last reply Reply Quote 0
            • I
              idan37s @johnpoz
              last edited by

              @johnpoz
              Not exactly,

              Under the "DNSBL Configuration" the option "Permit Firewall Rules" was always disabled (not checked), it was never enabled even before this issue, during or after.

              The "Floating Rules" was always Enabled (checked), and I meant that I just disabled the auto-generated floating rules manually one by one under the Firewall Rules UI.

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @idan37s
                last edited by

                @idan37s said in NAT Outbound not working between VLANs:

                just disabled the auto-generated floating rules manually one by one under the Firewall Rules UI.

                That has little to do with say a pfblocker process running that might hold of the change in the rules. I would disable that feature of pfblocker but keep pfblocker itself enabled and see if you have the problem. I do not let pfblocker do anything with firewall rules and just use it to create and update aliases that I manually use in my rules.

                If you could validate that specific thing is holding up the nat rules - then we could file a bug saying.. Turn this on outbound nats do not update, turn this off and they do, etc.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                I 1 Reply Last reply Reply Quote 0
                • I
                  idan37s @johnpoz
                  last edited by

                  @johnpoz
                  So just to make sure I understand,
                  I need to disable both of the options you send above ("Floating Rules", "Permit Firewall Rules") in PfBlockerNG and then test if the NAT Outbound is working as expected or not?

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @idan37s
                    last edited by

                    @idan37s yeah leave pfblocker enabled - just make sure its not doing any firewall rules anything.. If works then we can enable the one you had and see if stops it.. If so we have great details for actual bug because I will try and duplicate it.

                    I just don't see how pfblocker just doing aliases would have anything to do with it, and I am currently doing that and not having the issue your seeing.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    I 1 Reply Last reply Reply Quote 0
                    • I
                      idan37s @johnpoz
                      last edited by

                      @johnpoz
                      Sure, I will test and update with the details.

                      BTW, what do you mean by "just doing aliases"?
                      All the Actions in your PfBlockerNG are set to "disabled" and you just use the created aliases in your own FW rules?

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @idan37s
                        last edited by

                        @idan37s exactly I don't let it do anything but aliases - which I then put in my own manual rules.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        I 1 Reply Last reply Reply Quote 0
                        • I
                          idan37s @johnpoz
                          last edited by

                          @johnpoz
                          Ok,
                          So after tons of testing I think I can say it's the GeoIP causing the issue,
                          Not sure why, and it's not consistent 100% of the time,
                          But when Floating rules are enabled (and the interfaces are selected in inbound and outbound) and GeoIP is enabled as Deny Inbound, the issue exist.
                          I wasn't able to reproduce the issue when Floating Rules was disabled.

                          Sometimes even if Floating Rules was enabled and GeoIp was enabled then it worked (for example when changing the Floating Rules from disable to enable while GeoIp was enabled, it worked sometimes and no issue existed.

                          Only if i disabled all GeoIp, forced PfBlocker to reload all rules (under Update), Enabled GeoIp, forced reload again then the issue happened I think every time.

                          It also seems like for me, while I live in Israel (which is part of Asia Alias), Europe GeoIp caused more for the issue to happen, even if only one country from that filter was selected.

                          I know it's not 100% step by step on how to re-produce the bug but that's what I managed to gather so far, hope it's enough.

                          3d34463f-dbd7-4149-a18d-fe9ffc806a63-image.png

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.