Wan/VIP -> LAN issues

[m2oore]

I have been trying very hard to figure this out.  I have done a ton of reading here and can't seem to find the specific answer I am needing to fix the problem I am having.

Here is my setup
I have an ISP which has given me 5 IP addresses

Interfaces

WAN
Ipaddress:  66.XXX.XXX.138/29
gateway:  66.XXX.XXX.136

LAN
Ipaddress:  192.168.2.30/24

I have a Virtual IP
IPaddress:  66.XXX.XXX.140/29
PARP

What I want to do is route typical traffic from my interal users to my WAN interface and that is working correctly right now.  What I am having a problem with is that I need to route 2 specific HTTP ports to two seperate Interal IP address.

For Example

66.XXX.XXX.138 -> 192.168.2.33  *This is the WAN interface
66.XXX.XXX.140 -> 192.168.2.31  *This is the Virtual IP

I do a port forward as described in documentation in which I have both my WAN and my VIP specified as the sources and the corresponding IP's for local line specified in each NAT section.

The problem is that I can access both pages internally (with Nat Reflection Check - Unchecked) but, I can't seem to get an outside connection to those pages.

Can anyone give me a clue on how I can get this to work?

Thanks,

[GruensFroeschli]

If you connect from the outside: do you see something in the firewall log dropped?
Try as VIP type CARP (even if you dont need the CARP functionalities).

[dotdash]

A single proxy-arp address should be added as 66.XXX.XXX.140/32 (single address, not network)

[m2oore]

Changing it to CARP did the trick for me thanks!

[GruensFroeschli]

I didnt notice before but dotdash is right.

• With PARP you need to specify the correct IP with /32 If you want to map only one IP.
• With CARP you need to specify the actual CIDR subnet of the IP in your case /29.

PARP should work in your case too but if you want to run services on the pfSense on this VIP you should use CARP.