How can I use public IP's on the LAN?
-
Hi all,
I have the following question: How can I use public IP's on the LAN?
I did read the FAQ on this item but I can't get it to work.The FAQ states: "you need to disable NAT to use a public IP subnet on the LAN. Just enable Advanced Outbound NAT, and remove the automatically generated NAT rule to accomplish this." Nice, but what do I have to change in the webinterface to get it working…
I tried changing pfsense behavior in the following places (with no succes):
1. System \ Advanced: Network Address Translation Disable NAT Reflection Disables the automatic creation of NAT redirect rules for access to your public IP addresses from within your internal networks. Note: Reflection only works on port forward type items and does not work for large ranges > 500 ports.
2. Firewall \ NAT \ Outbound: Manual Outbound NAT rule generation (Advanced Outbound NAT (AON))Lets say my client machine on the LAN wants to access my webserver which is also on the LAN (for now) via the WAN address.
My WAN address is xyz.dyndns.org and the webserver is NATed to an ip on the LAN (from the outside it is accessible).
What step do I have to take, so that the client machine can read the webserver via http://xyz.dyndns.org.I hope someone can tell me the steps to get this working correctly.
Regards,
Joost. -
Search for reflection.
-
Search for reflection.
Joining the thread.
I've searched this, but found no working solution.
My external IP-range is 82...0 /26
Servers have local IP:s and I'm using 1:1 NAT mapping.
How can I kind of loop back via rules?// Assar
Update:
Found a way to override DNS.
Add servers in "Services/DNS forward".
This seems to work.Could be nice to be able to add a checkbox on 1:1 mapping if adress should be maped or not.
-
@http://forum.pfsense.org/index.php/topic:
NAT-Reflection does not work with 1:1 NAT
@http://forum.pfsense.org/index.php?topic=7266.msg41244:You most likely need to setup split dns or add a port forward on top of the 1:1 nat to invoke reflection. Reflection by default does not work with 1:1 nat's. So your most likely resolving the public IP address which will not forward back across to the 1:1 server.
-
Thanks!
My workaround seems to work well as long as everybody uses hosts listed in "Services: DNS forwarder".
I have to instruct developers not to use external IP-adresses.
This way external IP:s are avoided on LAN.// Assar
-
Solution for NAT via Port Forwarding:
System : Advanced : Network Address Translation
=> Uncheck the box in front of "Disables the automatic creation of NAT redirect rules for
access to your public IP addresses from within your internal networks. Note: Reflection
only works on port forward type items and does not work for large ranges > 500 ports."Regards,
Joost. -
-
It has been around quite some time already and if you search the forum you'll find quite old threads about it too.
-
It has been around quite some time already and if you search the forum you'll find quite old threads about it too.
I can not find the check box named reflection. May be I am just getting blind. Please help with the menu name in pfsense 1.2 final release. Thanks.
-
sticky:
@http://forum.pfsense.org/index.php/topic:System:
Advanced:
If you want to be able to use NAT-mappings from withing your own LAN disable the checkbox "Disable NAT Reflection" -
sticky:
@http://forum.pfsense.org/index.php/topic:System:
Advanced:
If you want to be able to use NAT-mappings from withing your own LAN disable the checkbox "Disable NAT Reflection"Thanks a ton. I have a public IP mapped to an internal lan IP host/server on port 80. When my lan machine try to reach this server through the public IP it does not work. It works if I use private IP or when I am trying to reach the server from outside the firewall.
If I disable the automatic creation of NAT redirect rules for access to your public IP addresses from within my internal networks, this behavior would disappear?
Am I on the right track here?
-
I'm not really sure what you mean.
To access your server via the public IP just uncheck, as several users already suggested, the "Disable NAT Reflection" checkbox.Why would you want to disable the autocreation of NAT rules?
-
I'm not really sure what you mean.
To access your server via the public IP just uncheck, as several users already suggested, the "Disable NAT Reflection" checkbox.Why would you want to disable the autocreation of NAT rules?
I am not sure I did… I think disable checkbox "on" is the default pfsense from installation..
-
yes.
Per default the checkbox is "on". (meaning no reflection rules will be installed)
But you have to turn the box "off". (meaning the reflections will be installed) -
yes.
Per default the checkbox is "on". (meaning no reflection rules will be installed)
But you have to turn the box "off". (meaning the reflections will be installed)Thanks - you are a hero!
-
I personally don't like the idea of Reflection, or in the Cisco PIX world, what they call DNS rewrites.
I've solved this problem many times with just an internal DNS server that is authoritative for the domain in question.
This is easy, especially since every LAN I work on I make sure there is a private DNS server that just goes to root hints if it doesn't already know what a workstation is querying for.
One DNS server for the public network queries, one DNS server for the private network queries.Scenario:
Web server's private IP = 10.10.240.1
Web server's public IP NAT'd 1-to-1 thru a firewall = 64.216.232.11
All hosts on the private 10.10.x.x/16 network have 10.10.240.100 as their primary DNS server in their TCP/IP configuration.
When a host queries for a name resolution, the server either knows it right off the bat because it's cached or because it's authoritative, or it goes directly to Root Hints and finds out.Web server's Internet-valid FQDN: www.mydomain.com
Desired end result:
People out on the internet get to web server via http://www.mydomain.com
People on the private ten-dot LAN want to get the web server with exactly the same name, http://www.mydomain.comTasks:
1. Create a static zone on the internal DNS server 10.10.240.100 for mydomain.com
2. Create an A record for www in the mydomain.com zone that resolves to 10.10.240.1
3. Test your work.
4. Have a beer, scotch, milk, or whatever it is you enjoy. ;) -
I personally don't like the idea of Reflection, or in the Cisco PIX world, what they call DNS rewrites.
I've solved this problem many times with just an internal DNS server that is authoritative for the domain in question.
This is easy, especially since every LAN I work on I make sure there is a private DNS server that just goes to root hints if it doesn't already know what a workstation is querying for.
One DNS server for the public network queries, one DNS server for the private network queries.Scenario:
Web server's private IP = 10.10.240.1
Web server's public IP NAT'd 1-to-1 thru a firewall = 64.216.232.11
All hosts on the private 10.10.x.x/16 network have 10.10.240.100 as their primary DNS server in their TCP/IP configuration.
When a host queries for a name resolution, the server either knows it right off the bat because it's cached or because it's authoritative, or it goes directly to Root Hints and finds out.Web server's Internet-valid FQDN: www.mydomain.com
Desired end result:
People out on the internet get to web server via http://www.mydomain.com
People on the private ten-dot LAN want to get the web server with exactly the same name, http://www.mydomain.comTasks:
1. Create a static zone on the internal DNS server 10.10.240.100 for mydomain.com
2. Create an A record for www in the mydomain.com zone that resolves to 10.10.240.1
3. Test your work.
4. Have a beer, scotch, milk, or whatever it is you enjoy. ;)Ah - The joys of Scotch. Its the next best thing since the earlier peg of scotch!!
I hope you don't mind my writing off the forum because my notes might just be too flooding for people who are guru there.
1. Pfsense comes with a dns package. Would you think that it will suffice?
2. My domain is hosted with 1and1 and I am using http redirect to a specific IP, and in such cases, would you say that this solution still holds?
3. I also have problems when people are trying to reach public IP for example 138.99.151.72:8085. I think there is some disclaimer about ports greater than 500 not working with reflection unless some more recipe is applied..
Any help will be appreciated.
-
…
1. Pfsense comes with a dns package. Would you think that it will suffice?
2. My domain is hosted with 1and1 and I am using http redirect to a specific IP, and in such cases, would you say that this solution still holds?
3. I also have problems when people are trying to reach public IP for example 138.99.151.72:8085. I think there is some disclaimer about ports greater than 500 not working with reflection unless some more recipe is applied..
You can use the dnsforwarder of the pfSense. Just make your local DNS server forward everything it doesn't find to the pfSense and enter that override there.
Reflection does work for ports higher 500, just not for portranges(!) greater than 500 ports.
-
1. I just took a look at Services:DNS Forwarder in my pfSense box. It looks like you might could create some records there to intercept LAN name queries.
a. a host on the LAN queries for www.mydomain.com
b. the DNS server for www.mydomain.com is an internet domain server, say out on 1&1
c. pfSense intercepts that query, because DNS Forwarder is turned on and IT is the primary DNS server as far as your LAN host is concerned
d. pfSense says "aha! I have an entry for www.mydomain.com that points back to this IP (on the LAN)"' and gives it to your workstation host.In this scenario, public hosts still get the public IP from 1&1, but private hosts - who ask the pfSense box for IPs when doing a DNS query - get whatever records you define there on the DNS Forwarder page.
2. I'm not sure by what you mean with the http redirect, etc. - but yes, I think it should still hold.
3. Create a name for that IP! 138.99.151.72
a. Create a name at 1&1 that services the public network. eightyeightyfive.yourdomain.com for example, that resolves to 138.99.151.72
b. Create a record on pfSense's DNS Forwarder page that will intercept LAN host queries for eightyeightyfive.yourdomain.com - it will NOT give them 138.99.151.72, it will give them whatever the private IP is for that server. -
1. I just took a look at Services:DNS Forwarder in my pfSense box. It looks like you might could create some records there to intercept LAN name queries.
a. a host on the LAN queries for www.mydomain.com
b. the DNS server for www.mydomain.com is an internet domain server, say out on 1&1
c. pfSense intercepts that query, because DNS Forwarder is turned on and IT is the primary DNS server as far as your LAN host is concerned
d. pfSense says "aha! I have an entry for www.mydomain.com that points back to this IP (on the LAN)"' and gives it to your workstation host.In this scenario, public hosts still get the public IP from 1&1, but private hosts - who ask the pfSense box for IPs when doing a DNS query - get whatever records you define there on the DNS Forwarder page.
2. I'm not sure by what you mean with the http redirect, etc. - but yes, I think it should still hold.
3. Create a name for that IP! 138.99.151.72
a. Create a name at 1&1 that services the public network. eightyeightyfive.yourdomain.com for example, that resolves to 138.99.151.72
b. Create a record on pfSense's DNS Forwarder page that will intercept LAN host queries for eightyeightyfive.yourdomain.com - it will NOT give them 138.99.151.72, it will give them whatever the private IP is for that server.Wow - Kris this is magic and you are such a good explainer. I am sure you teach well to anyone whio comes for your help in your area,=.
Many thanks again. I feel the above explanation could be somewhere in howto..
My best regards
Anil Garg
