Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple WAN interfaces - NAT problem

    Scheduled Pinned Locked Moved NAT
    13 Posts 2 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Mister.Deeds @viragomann
      last edited by

      @viragomann Thanks for the answer

      So internet works well on LAN devices?
      -> Internet works normally. Even if the website is accessed via a client that goes through the default gateway, it works. Only when the client goes via the LTE gateway it does not work.

      Are you talking about a LAN client calling one of the nated address?
      Do you use the IP or a host name?
      -> Exactly, I want to use a LAN client to access the web page which is nated behind the public IP of the firewall. use the hostname (DNS) name from the website. But also with the IP the result is identical. The connection is not nated.

      There is no need to have this unchecked as long as there are no incoming connections on the LTE and the modem does masquerading on it.
      -> All right, then I set the checkboxes again

      Do you have any other ideas? Thanks alot and best regards

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @Mister.Deeds
        last edited by

        @misterdeeds-0
        The rule you posted above for the source 172.16.0.22 policy routes any traffic to the LTE gateway.
        Can't see if there is another rule in place allowing the desired access, but if this rule is applied it can't work at all.

        M 1 Reply Last reply Reply Quote 0
        • M
          Mister.Deeds @viragomann
          last edited by

          @viragomann said in Multiple WAN interfaces - NAT problem:

          The rule you posted above for the source 172.16.0.22 policy routes any traffic to the LTE gateway.
          Can't see if there is another rule in place allowing the desired access, but if this rule is applied it can't work at all.

          Thanks for the feedback. Here are still all the firewall rules.
          Unbenannt.PNG

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @Mister.Deeds
            last edited by

            @misterdeeds-0
            As I mentioned above, you're policy routing traffic to the LTE gateway. What's the sense of this?

            These rules directs any matching packet to the LTE gateway, hence the concerned IPs are not able to access any local destinations.
            So with these rules in place you need an additional for the source IP in question to pass traffic to local destinations, where you don't have to set the gateway option.

            M 1 Reply Last reply Reply Quote 1
            • M
              Mister.Deeds @viragomann
              last edited by

              @viragomann said in Multiple WAN interfaces - NAT problem:

              As I mentioned above, you're policy routing traffic to the LTE gateway. What's the sense of this?
              These rules directs any matching packet to the LTE gateway, hence the concerned IPs are not able to access any local destinations.
              So with these rules in place you need an additional for the source IP in question to pass traffic to local destinations, where you don't have to set the gateway option.

              These clients should only go via the LTE gateway and never via the standard gateway.

              I have now created the following rule. Unfortunately, this does not make any difference.

              Unbenannt.PNG

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @Mister.Deeds
                last edited by

                @misterdeeds-0
                You cannot pass packets to WAN address over the WAN gateway! That cannot work, the packets would never come back.

                I told you to not touch the gateway option in the rule.

                M 1 Reply Last reply Reply Quote 0
                • M
                  Mister.Deeds @viragomann
                  last edited by

                  @viragomann And what should the rule be if I want the two clients to always go through the LTE gateway but be able to reach the address on the WAN gateway?

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @Mister.Deeds
                    last edited by

                    @misterdeeds-0
                    Just edit the rule for WAN address and set the gateway to "default".
                    This rule is applied only if the destination is the WAN address. For all other destinations it is skipped and the next one is probed.

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      Mister.Deeds @viragomann
                      last edited by

                      @viragomann said in Multiple WAN interfaces - NAT problem:

                      Just edit the rule for WAN address and set the gateway to "default".
                      This rule is applied only if the destination is the WAN address. For all other destinations it is skipped and the next one is probed.

                      Ok, but how can I define that only these two clients permanently connect to the Internet via LTE gateway?

                      V 1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @Mister.Deeds
                        last edited by

                        @misterdeeds-0 said in Multiple WAN interfaces - NAT problem:

                        @viragomann said in Multiple WAN interfaces - NAT problem:

                        Just edit the rule for WAN address and set the gateway to "default".
                        This rule is applied only if the destination is the WAN address. For all other destinations it is skipped and the next one is probed.

                        Ok, but how can I define that only these two clients permanently connect to the Internet via LTE gateway?

                        This do the other two rule with the gateway stated.

                        However, I assume there client also need to access other internal destinations, for instance the DNS Resolver running on pfSense.
                        So best practice is to add an alias and add all private networks to it. Call the alias RFC1918. Mine looks like this
                        c4f7676a-af4f-45b1-adb0-0b248d27ec41-grafik.png

                        Then edit the policy routing pass rule. At destination check "invert", select "Single host or alias" and enter the alias name (here RFC1918).
                        With the invert checked means, it applies to any destination, but not the alias and pass the traffic to the LTE gateway.

                        In you case you can also add your WAN address to this alias, so that it is also excluded from passing to LTE.
                        However, basically there should not be any need to access the WAN IP from inside your network. If you want to use a public FQDN for accessing internal devices, you should better add a DNS override to your local DNS.

                        M 1 Reply Last reply Reply Quote 2
                        • M
                          Mister.Deeds @viragomann
                          last edited by

                          @viragomann Great tip, that's how it works for me. Thanks you very much for the effort!!!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.