Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Configuring Transparent Mode

    Scheduled Pinned Locked Moved NAT
    28 Posts 4 Posters 8.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      globalmcs
      last edited by

      I haven't tried it, I'll do so tonight - I'm not there right now and dont have remote access yet.

      1 Reply Last reply Reply Quote 0
      • G
        globalmcs
        last edited by

        I changed the OPT rule to one
        Proto  Source  Port  Destination  Port  Gateway  Schedule
        *              *              *      *                      *      *

        I was able to ping the WAN Gateway from the pfSense console

        Ping output:

        PING 24.xxx.xxx.49 (24.xxx.xxx.49) from 24.xxx.xxx.50: 56 data bytes
        64 bytes from 24.xxx.xxx.49: icmp_seq=0 ttl=64 time=1.537 ms
        64 bytes from 24.xxx.xxx.49: icmp_seq=1 ttl=64 time=1.262 ms
        64 bytes from 24.xxx.xxx.49: icmp_seq=2 ttl=64 time=2.456 ms

        –- 24.xxx.xxx.49 ping statistics ---
        3 packets transmitted, 3 packets received, 0.0% packet loss
        round-trip min/avg/max/stddev = 1.262/1.752/2.456/0.511 ms

        I ran the packet capture on the WAN interface and pinged 24.xxx.xxx.49  from the server in OPT1 and here is what I got

        12 2.041353 00:50:56:94:1a:b4 Broadcast ARP Who has 24.XXX.XXX.49?  Tell 24.XXX.XXX.51
        13 2.782611 24.XXX.XXX.50 24.XXX.XXX.49 ICMP Echo (ping) request
        14 2.783796 24.XXX.XXX.49 24.XXX.XXX.50 ICMP Echo (ping) reply
        21 3.783133 24.XXX.XXX.50 24.XXX.XXX.49 ICMP Echo (ping) request
        22 3.784322 24.XXX.XXX.49 24.XXX.XXX.50 ICMP Echo (ping) reply
        23 4.784588 24.XXX.XXX.50 24.XXX.XXX.49 ICMP Echo (ping) request

        So the server broadcast who has 24.XXX.XXX.49, the ping starts from the WAN IP and the Gateway replies back to the WAN IP instead of the Server IP

        1 Reply Last reply Reply Quote 0
        • D
          danswartz
          last edited by

          Aha.  It sounds like it is doing NAT for some reason.  If you go to firewall => NAT => Outbound, what do you see?

          1 Reply Last reply Reply Quote 0
          • G
            globalmcs
            last edited by

            The option "Automatic outbound NAT rule generation (IPsec passthrough)" is selected.

            1 Reply Last reply Reply Quote 0
            • D
              danswartz
              last edited by

              aha, click to AON (manual) and delete the rule that then appears.

              1 Reply Last reply Reply Quote 0
              • G
                globalmcs
                last edited by

                I did it and lost internet connectivity from the LAN and the OTP1 still the same.
                I selected the "Automatic outbound NAT rule generation (IPsec passthrough)" back.

                1 Reply Last reply Reply Quote 0
                • D
                  danswartz
                  last edited by

                  sorry, my bad.  re-enable manual AON and tell me what rule you see.

                  1 Reply Last reply Reply Quote 0
                  • G
                    globalmcs
                    last edited by

                    Its ok, I appreciate you trying to help me.
                    Here is the only rule when manual AON is Enabled

                    Interface  Source        Source Port Destination Destination Port  NAT Address  NAT Port  Static Port  Description 
                    WAN          192.168.1.1/24 *         *       *                 *                 *         NO                 Auto created rule for LAN

                    1 Reply Last reply Reply Quote 0
                    • D
                      danswartz
                      last edited by

                      okay, that is correct.  can you post contents of /tmp/rules.debug?

                      1 Reply Last reply Reply Quote 0
                      • G
                        globalmcs
                        last edited by

                        I hope you dont mind but I emailed it to you, didn't want to post it.

                        1 Reply Last reply Reply Quote 0
                        • G
                          globalmcs
                          last edited by

                          Hey Dan, I just wanted to let you know that with version "2.0-BETA3" the Transparent Mode (bridge) is working. I notice one issue on the server in OPT1, if I restart it can't get out to the internet 'till I "repair" the network connection.

                          By repair I mean, in Windows going to Network Connections right clicking on the connection and selecting the option to repair.

                          Thanks for all your help

                          1 Reply Last reply Reply Quote 0
                          • D
                            danswartz
                            last edited by

                            glad it is working.  if this server has a static IP what you are describing is odd.  be interesting to run a packet trace on the OPT1 interface after booting the server and then doing the repair.

                            1 Reply Last reply Reply Quote 0
                            • G
                              globalmcs
                              last edited by

                              Hi, sorry I didn't get back to you sooner, I was not able to reproduce the error to run a packet capture - I'll make sure to run capture it if it ever happens again.

                              Thank you again for all your help!

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.