Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT)
-
@riahc8 if you’re trying to connect to a VPN server on pfSense you’ll need to forward the ports in your ISP router, or make yours the ISP router’s DMZ to forward all ports.
Re: "block private networks" on WAN that’s for inbound and actually isn’t needed to connect to the ISP router from pfSense LAN. The open state will allow the response.
-
@SteveITS hey there,
I agree to 100 % considering my "block private" remark...I only got that as well for using VPN...my mistake, did not want to confuse anyone...
:) -
@the-other said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
Firewall rules: do NOT activate "block private networks" since your ISP router is in a private network...
The only time this would "matter" is if you had devices on this rfc1918 address space between your isp device and pfsense. And you wanted to be able to access stuff behind pfsense from this network..
can I just disable NAT on the pfSense to avoid the double NAT?
Would depend on your isp device.. But most likely not - for one this isp device would have to auto nat these downstream networks, it most likely would not do that - and only nat the network its attached to, ie your 192.168.22 network, some downstream network say 192.168.11/24 might not be natted by this isp device to your public IP.
Even if it did nat anything coming into its lan side.. How would it know how to send traffic back to say a 192.168.11.x address? You wold have to be able to put routes on the isp saying hey to get to 192.168.11 talk to pfsense IP on the 192.168.22 network.. ISP gateway devices most likely will not support such a feature.
Overall running double nat most likely will not be any sort of issue for most users.. Its a bit more complicated if you want to run servers behind pfsense where you would have to setup double port forwards, one on your isp to pfsense wan IP, and then another on pfsense to the server behind it.
Nat reflection most likely would be pita, prob not work. But overall most users don't have any problems with it.. There are people running behind triple or even quadruple nat.. While it is not optimal - its not the end of the world either.
If you use UPnP - that most likely not going to work either, etc.
-
First, thank you all for the help
I also have to disable the firewall on the ISP router
-
@riahc8 Is that a question or a statement?
-
@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
@riahc8 Is that a question or a statement?
That would be a statement. This way I allow all traffic to the pfSense and from there....handle it
When setting this up, I can still have devices connected to the original ISP router correct?
-
@riahc8 For port forwarding, yeah isp routers call that dmz host, etc.. where it forwards all traffic to specific IP behind it. yeah you would most likely want to do that if you plan doing any port forwarding on pfsense.
-
@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
@riahc8 For port forwarding, yeah isp routers call that dmz host, etc.. where it forwards all traffic to specific IP behind it. yeah you would most likely want to do that if you plan doing any port forwarding on pfsense.
From what Im seeing on this ISP router, port forwards automatically opens up the FW rule.
VPN is working :)
NAT Loopback isnt but.....I dont know if I currently use it for something although would be niice
-
@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
NAT Loopback isnt but.
Nat reflection or loopback can be problematic for sure in a multinat environment.. Your public IP sits on the isp device.. You would have to set it up on there, but even if worked going to be hairpin nightmare..
Nat loopback or reflection is a horrible work around to a specific problem and should be avoided whenever possible.
The only time it really is required to get something to work is when the client wanting to go there does not use local dns, or is hard coded to go to some public IP, etc.
Getting to something that is local on your network anyway - it is better to just go to the local IP directly, or have whatever fqdn your trying to go to resolve to the local IP vs the public IP, that you would have to reflect back in, creating hairpin traffic and not very optimal.
-
Is there a way to get it to work? Just noticed that I have a bunch of Nagios checks that depend on it :( Dont want to do it all over again
-
@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
Is there a way to get it to work? Just noticed that I have a bunch of Nagios checks that depend on it :( Dont want to do it all over again
Pf, I made a DNS entry un my Pi-Hole pointing to the local address...
-
@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
Nagios checks that depend on it
Checking what exactly.. I would assume your nagios is checking stuff on your local network - why would you use your public IP to get to stuff that is local?
Even if nat reflection worked for what your doing, its not really a valid check that public could get to it.
I would take the time to setup your nagios to check the local IP of what your wanting to check, or use a fqdn for your different things that resolve to the actual local IP of what your wanting to talk to for a check of something.
-
@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
Nagios checks that depend on it
Checking what exactly.. I would assume your nagios is checking stuff on your local network - why would you use your public IP to get to stuff that is local?
Even if nat reflection worked for what your doing, its not really a valid check that public could get to it.
I would take the time to setup your nagios to check the local IP of what your wanting to check, or use a fqdn for your different things that resolve to the actual local IP of what your wanting to talk to for a check of something.
(I think) I fixed it: My DDNS now points to my local IP with a dns entry on the Pi-Hole
-
How do I setup my WAN to get the internet connection from my ISP router?
- Connect the pfSense`s WAN port to one
LAN port of the ISP router. If there is no
switch in game and the pfSense is
connected directly to that LAN port you
could try out using "Exposed host", but
only on that port and for the pfSense!
Not for the entire ISP router!
Also, can I just disable NAT on the pfSense to avoid the double NAT?
NAT on pfSense, is a later process in the pf
(packet filter).Will the devices on the LAN interface on
the pfSense work?pfSense DHCP: On
ISP router DHCP: OffWhat do I do with VPN setup on the pfSense?
If you are using the "Exposed host" method, all
traffic will be reaching then the WAN port from
the pfSense firewall. - Connect the pfSense`s WAN port to one
-
@Dobby_ said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
Will the devices on the LAN interface on
the pfSense work?pfSense DHCP: On
ISP router DHCP: OffIn my case, I need to leave both on as devices are hanging off the ISP router
-
@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
@Dobby_ said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):
Will the devices on the LAN interface on
the pfSense work?pfSense DHCP: On
ISP router DHCP: OffIn my case, I need to leave both on as devices are hanging off the ISP router
Related subject: https://forum.netgate.com/topic/180704/access-network-behind-a-double-nat
