Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Automatic outbound NAT showing old subnets and not picking up new ones

    NAT
    2
    9
    507
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      ppcs-sysadmin
      last edited by

      Is it safe to delete existing outbound nat's created by automatic for subnets that no longer exist but still show up in the list?
      Is there an upper limit to the max number or nat's it can create? New subnets are not getting added by default, is there a command tore-run automatic NAT?

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @ppcs-sysadmin
        last edited by johnpoz

        @ppcs-sysadmin huh? If I create a new network, auto adds it. But if I delete it, it should be removing it as well

        So for example.. What I show before, then created a 192.168.5.0/24 network gave pfsense an IP.. It gets added to the outbound nat. I then delete said interface and its removed from the outbound nat.

        interfaces.jpg

        Are you saying in auto mode, you have outbound nats listed for networks you have no interface on pfsense set to?

        Are these networks via downstream gateway and route?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • P
          ppcs-sysadmin
          last edited by

          What I am seeing is lots of disabled static routes and while my new subnet is in the auto section, it appears not to work. The only difference is instead of a 192.168.x.x address, it is a 10.118.x.x address if that makes it function differently.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @ppcs-sysadmin
            last edited by

            @ppcs-sysadmin said in Automatic outbound NAT showing old subnets and not picking up new ones:

            lots of disabled static routes

            If its just disabled? Then I would think it could still be listed. But when you remove it then it should go away.. If your no longer using the routes why not just delete them?

            Doesn't matter what the network is, could be public IP space even.. With auto it should be added to nat to the wan interface, etc.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            P 1 Reply Last reply Reply Quote 0
            • P
              ppcs-sysadmin @johnpoz
              last edited by

              @johnpoz ab8c2e78-cf89-44dc-822c-e8c5f6defd87-image.png
              When in Auto only mode I assume all the grey'ed out lines are disabled. The auto box does show the interface's information but traffic never reaches the WAN

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @ppcs-sysadmin
                last edited by johnpoz

                @ppcs-sysadmin that doesn't look like your in auto mode.. You hit save after changing to auto?

                When you do like disable outbound nat or something it would throw your auto into mapps and they would be like gray like that

                disable.jpg

                If I then turn auto back on

                auto.jpg

                See how it says automatic rules - you need to make sure you hit save and apply, etc..

                You can then delete those old mappings by clicking the trash can icon

                oldmappings.jpg

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • P
                  ppcs-sysadmin
                  last edited by

                  I deleted the old statics then rebooted the firewall. The auto shows all my subnets going to the WAN but it did not fix the issue.
                  All 192.168.* subnets nat out to the WAN. My one single 10.* subnet does not.
                  Still feels this as something to do with using a 10.x.x.x network. I'll try to substitute a 192.168 as a test if I can't find other items to try tonight

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @ppcs-sysadmin
                    last edited by johnpoz

                    @ppcs-sysadmin Do you have some rule that forces 10 out some other gateway? You can use a 10.network dude..

                    You see your network in the auto nat, then it would be natted - what are the rules you have on this interface you created?

                    Why do you have what address your going to nat to blocked out.. So your running vips? On your wan? So your saying the traffic is leaving your wan with the source 10.x address? Sniff on your wan - show your state table, etc..

                    Here - I added a 10.x network..

                    10address.jpg

                    Working just fine - see my state where it natted my 10.1.2.100 address to my wan IP..

                    Here is answers coming back

                    natsource.jpg

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • P
                      ppcs-sysadmin
                      last edited by

                      Rookie mistake. Testing using a cell phone and missed the DNS issues on the new subnet ;(
                      Thanks for being so responsive.

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.