Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT)

riahc8

First, thank you all for the help

I also have to disable the firewall on the ISP router

johnpoz

@riahc8 Is that a question or a statement?

riahc8

@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@riahc8 Is that a question or a statement?

That would be a statement. This way I allow all traffic to the pfSense and from there....handle it

When setting this up, I can still have devices connected to the original ISP router correct?

johnpoz

@riahc8 For port forwarding, yeah isp routers call that dmz host, etc.. where it forwards all traffic to specific IP behind it. yeah you would most likely want to do that if you plan doing any port forwarding on pfsense.

riahc8

@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@riahc8 For port forwarding, yeah isp routers call that dmz host, etc.. where it forwards all traffic to specific IP behind it. yeah you would most likely want to do that if you plan doing any port forwarding on pfsense.

From what Im seeing on this ISP router, port forwards automatically opens up the FW rule.

VPN is working :)

NAT Loopback isnt but.....I dont know if I currently use it for something although would be niice

johnpoz

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

NAT Loopback isnt but.

Nat reflection or loopback can be problematic for sure in a multinat environment.. Your public IP sits on the isp device.. You would have to set it up on there, but even if worked going to be hairpin nightmare..

Nat loopback or reflection is a horrible work around to a specific problem and should be avoided whenever possible.

The only time it really is required to get something to work is when the client wanting to go there does not use local dns, or is hard coded to go to some public IP, etc.

Getting to something that is local on your network anyway - it is better to just go to the local IP directly, or have whatever fqdn your trying to go to resolve to the local IP vs the public IP, that you would have to reflect back in, creating hairpin traffic and not very optimal.

riahc8

Is there a way to get it to work? Just noticed that I have a bunch of Nagios checks that depend on it :( Dont want to do it all over again

riahc8

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Is there a way to get it to work? Just noticed that I have a bunch of Nagios checks that depend on it :( Dont want to do it all over again

Pf, I made a DNS entry un my Pi-Hole pointing to the local address...

johnpoz

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Nagios checks that depend on it

Checking what exactly.. I would assume your nagios is checking stuff on your local network - why would you use your public IP to get to stuff that is local?

Even if nat reflection worked for what your doing, its not really a valid check that public could get to it.

I would take the time to setup your nagios to check the local IP of what your wanting to check, or use a fqdn for your different things that resolve to the actual local IP of what your wanting to talk to for a check of something.

riahc8

@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Nagios checks that depend on it

Checking what exactly.. I would assume your nagios is checking stuff on your local network - why would you use your public IP to get to stuff that is local?

Even if nat reflection worked for what your doing, its not really a valid check that public could get to it.

I would take the time to setup your nagios to check the local IP of what your wanting to check, or use a fqdn for your different things that resolve to the actual local IP of what your wanting to talk to for a check of something.

(I think) I fixed it: My DDNS now points to my local IP with a dns entry on the Pi-Hole

Dobby_

@riahc8

How do I setup my WAN to get the internet connection from my ISP router?

Connect the pfSense`s WAN port to one
LAN port of the ISP router. If there is no
switch in game and the pfSense is
connected directly to that LAN port you
could try out using "Exposed host", but
only on that port and for the pfSense!
Not for the entire ISP router!

Also, can I just disable NAT on the pfSense to avoid the double NAT?

NAT on pfSense, is a later process in the pf
(packet filter).

Will the devices on the LAN interface on
the pfSense work?

pfSense DHCP: On
ISP router DHCP: Off

What do I do with VPN setup on the pfSense?
If you are using the "Exposed host" method, all
traffic will be reaching then the WAN port from
the pfSense firewall.

riahc8

@Dobby_ said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Will the devices on the LAN interface on
the pfSense work?

pfSense DHCP: On
ISP router DHCP: Off

In my case, I need to leave both on as devices are hanging off the ISP router

riahc8

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@Dobby_ said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Will the devices on the LAN interface on
the pfSense work?

pfSense DHCP: On
ISP router DHCP: Off

In my case, I need to leave both on as devices are hanging off the ISP router

Related subject: https://forum.netgate.com/topic/180704/access-network-behind-a-double-nat