NAT addressing problem

DrydenK 0

Hi,

I'm trying to set a VPN server for my contingency/backup link. When my primary link fails, I have a 30Mbps link that has one IP address. In my normal link, I have a class C network (/24 public addresses) where I don`t use NAT. When I activate the backup link, I want to enable my users to access my network through pfSense. pfSense is already the router for this link.

I`ve set ipSec using the instructions on https://docs.netgate.com/pfsense/en/latest/recipes/ipsec-mobile-ikev2-eap-mschapv2.html. Then I made small changes to allow Radius authentication (EAP-Radius). The network setup became something like this:

public IP
................
|
pfsense
|
...............
internal network with valid IP's, but behind pfsense/NAT

The setup is mostly working. When a user connects, it manages to navigate to external sites, but internal navigation does not work. What I found is that packets to the LAN are going out with the network set in "Virtual Address Pool" network set in the "Mobile clients" tab. So, when a VPN connected user tries to access a server in my network, my servers with valid IP's are receiving packets with rfc1918 addresses, and obviously they will not answer that.

So, in short this is what seems to be happening with the packets coming out of the tunnel:
to WAN: NAT is translated properly
to LAN: packets are coming out with RFC1918 address (not disarable).

How can I tell pfSense that the packets to the LAN should also be translated?

Thank you,

Roberto

SteveITS

@drydenk-0 I think you're looking for outbound NAT.
Also see here.

DrydenK 0

Cool. Outbound NAT worked. Well, sorta.

It gave me some trouble because for some reason it refused to translate ICMP. HTTPS (and RDP) worked fine, but ICMP did not. I tried to add a rule specifying icmp, but still didn't translate it. I tried with both Hybrid and Manual Outbound NAT, both with the same result.

In any case, it already solved what I needed. I will make some more tests and report if I find something.

Thank you.

Roberto

DrydenK 0

Aaaannnndd it started working, somehow.

I played a little with "Rekey Time" and " Reauth Time" but didn't get the results I expected, so I disabled them (which is what I had before). But somehow, icmp translation started to work. Now it works but I don't know why..... :-P

Tks.

Roberto