Please help me oh mighty gods of pfsense and nat reflection
-
@fagoti
Ah yes, that's an issue. DNS does not consider your port translations.You can only resolve a single host name to a single IP.
E.g.
host1.mypfsense.com > 172.16.100.11
host2.mypfsense.com > 172.16.100.12So you would need to call host2.mypfsense.com:2222 to get to 172.16.100.12:2222.
i can only think proxy is interfering in some way, and blocking pure nats when source is from different ip class other then his own.
The NAT proxy is out of play with DNS overrides.
-
thats a bummer :(
well, i guess thats thats a way to solve it .maybe i should create and redo all links in that fashion
dont know if im really happy with it, but i think i will start doing it right away, so that really becomes an option.
its sad cause.. it would be fantastic if a single domainlink could work inside and outside my network, always reaching for the pfsense and always getting translated to according port.
but for now i think i gonna stop the efforts.
now im just eager to know why pure nat over proxy still works on the same network but not in the subnetworks routed.....
-
@fagoti
The issue with the NAT reflection, which you described in the first post, may possibly indicate an asymmetric routing issue. But you would have to investigate this.
You can use packet capture on pfSense to check if request and response packets passes pfSense properly. -
@viragomann i will try that, im afraid im not exactly great on that , but im try my best.
as for your suggestion , i just did a sample here, and it works well.. but yes... im gonna have to notify every client, change every link in every station.
and will be exactly like this
host1.mypfsense.com > 172.16.100.11
host2.mypfsense.com > 172.16.100.12the ultimate bummer, is that, one might think it would be really nice to use that oportunity to have outside domainnames that can be typed without the ports and redirected apropriatedly,...
but, if i do that, i will have to use a link for for external (with no ports) and a link for internal (with ports)... and to have 2 links will drive people nuts...so unfortunatelly i will be creating those subdomains with the redirects without ports,, and use the ports in every link so the external and internal links match.
thanks for all your time and attention
greating from brazil!
-
@fagoti
Yes, when using certain ports with NAT reflection, it cannot be simply replaced with DNS overrides.However, there is a simpler method to detect asymmetric routing, assuming the issue concerns to TCP connections:
In Status > System Logs > Settings ensure that "Log packets matched from the default block rules in the ruleset" is enabled.After facing an issue check the firewall log. If you have asymmetric routing you would see block of TCP packets with other than SYN flags, e.g. RA, PA.
-
@fagoti said in Please help me oh mighty gods of pfsense and nat reflection:
active directoty /dns - 172.16.100.1
main local network 172.16.0.0 / 16
routers 172.16.200.0 / 24Ok this problematic - so your lan is 172.16/16 but you have some other router a 172.16.200/24 - that overlaps.. Can you do a drawing.. If you have a downstream router that really should be on a transit, unless this downstream router is doing nat? if that is the case why would it be on some 172.16.200/24 that overlaps your /16?
-
thanks for trying to help too john,
my lan is indeed /16 and the subclass 200.X is reserved to routers
then , this routers are all 200.x on wan and have dhcp 192.168.x.x for their lan.client 192.168.x.x access without problems servers on 172.16.x.x
but those routers are not using nat of any kind.
-
@fagoti so its really just 172.16/16 your just putting all your routers on 172.16.200/16 range of IPs
but those routers are not using nat of any kind.
That is going to be asymmetrical, if your downstream routers are not doing nat, then that network from your upstream to downstream should be a transit network, no hosts on it..
If I am understanding yoru setup this is asymmetrical.
either direction ends up with asymmetrical flow, unless you were doing host routing on the clients on your 172.16/16 network
When you use downstream routers that do not nat, you should be using a transit network.
-
@johnpoz oh my, you even made diagrams... :) , thanks again, but now it got a little overwhelmed with that many networks and information
i wont be asking for more until i manage to study this with the same care and fully understand it
but it seems like a lot of changes for my already huge network.
-
@fagoti said in Please help me oh mighty gods of pfsense and nat reflection:
but it seems like a lot of changes for my already huge network.
Creating a transit is not a lot of work.. But running downstream routers that don't nat are going to cause you all kinds of grief without a transit network.. Or doing host routing on ever host..
Transit network is the correct solution..
-
im trying to reply but i keep receiving akismet spam message :/
-
im gonna try breaking my reply in parts
-
It seems you know what you are talking about.
I will give it a shot on a smaller scale here. -
I have just finished doing the "B PLAN" kindly suggested by @viragomann , and its working,
its not pretty, and has lots of places to check when it goes bad,.. but works.
i will be planning how to change all those links for everyone...
but even if i later manage to use your refined transit idea, i can still use those new links i build for split dns, so.. i guess its a good idea to go all the way with it.
-
thanks john
and by the way @viragomann thanks again, because of your quick tip i ended up improving my understanding of my win.dns features.
-
@viragomann i managed to implement a working split dns here. im quite satisfyied.
i still want to test @johnpoz advices. (but its crazy here, i have like 50 routers.. i think it would be a mess to go with it)
-
@fagoti
The transit network is needed if devices in the main network 172.16.0.0/16 should be able to communicate with devices in 192.16.0.0/24 behind routers. I didn't consider that this would be desired before.However, if you need this you can simply do that with a VLAN on the same wire. Create a VLAN on pfSense and on the routers, ensure that it doesn't overlap with other subnets, and point a static routes on both routers for the network behind them to the VLAN IP of each other.
-
@fagoti said in Please help me oh mighty gods of pfsense and nat reflection:
have like 50 routers..
Why and the F would you have so many routers.. But ok if you had like 2000 of them you could still put them on a transit network..
What are these routers.. Why would you need so many? What are they?
-
@johnpoz its a huge network... spread among a number of buildings and neighborhoods.. some of them with 20 or something rooms...
and on top of that, lots of different models of routers, more than one ptp optic fiber provider, some vlans, its pretty messy...
but its working.
and with the split dns i managed to make a little more time on that masterplanning of a better topology :P
-
@fagoti are you running in a mesh topology setup? You could also test out changes I learned with GNS3 it's a virtual network system. Just set up a virtual test with virtual versions all the routers and items all airgapped for your test. A virtual research test version of your network. GNS3 also lets you load OS onto VMs even add in servers and have it function if needed while testing it. Just double click on the host and it opens. Our cybersecurity Professor showed it off on our last days of class. It's cool. Wicked cool. That reminds I want to play with it tomorrow.
(GNS3)Ref:
https://gns3.com/I would also start testing out whitebox routers up so I could push down changes to all the routers at once from the control system. also know as SDN (Software Defined Networking).
