Nat behind nat

[Jannus]

Hi guys,

I have an Pfsense firewall installed in my network for quite a long time with subnet 172.18.x.x /16 the wan (172.20.0.252) side lays in another natted network 172.20.x.x /16
Everything works fine except for one thing.

I have an UPS installed in the 172.20.x.x subnet and i try to connect to some machines in the 172.18.x.x network wich have software installed to communicate with the ups.
the connection fails all the time.

In the UPS log i see there is a client connected with ip adress 172.20.0.252 , thats the IP adress of the wan side of the Pfsense firewall!!
It looks like something goes wrong with the source address, he doesnt see its a client from another network.

Is this a poor implementation of nat on the pfsense machine or the UPS? Can someone explain what is happening here. The traffic from the UPS flows to a Nokia Checkpoint, there is a static route defined to the 172.18.x.x network. From the 172.18.x.x network, traffic is directly routed in too the 172.20.x.x network

[Jannus]

any idea? ???

[danswartz]

This is not poor anything, the default for pfsense is to NAT outbound traffic.  If you are internal to another network so that you don't need NAT, just disable it.

[Jannus]

Allright, i assume to turn off the following option?

Disable all packet filtering.
Note: This converts pfSense into a routing only platform!
Note: This will turn off NAT!

[jimp]

No, that is not the correct option.

Enable Manual Outbound NAT, and remove all of the rules.

[Jannus]

allright, selected manual outbound rules and deleted one rule (the only rule).

now i have the problem i can't reach the 172.20.x.x network from the 172.18.x.x , in reverse it works??? ???

[Jannus]

UPDATE

when i add a static route to my machine (172.20.0.179) to the 172.18.x.x network everything is working fine.

So i think it has something to do with our nokia checkpoint.

Something like asynchronous routing?

Because traffic flows from the 172.18.x.x directly into the 172.20.x.x network and from the 172.20.x.x network it goes first through a nokia checkpoint and then back to the pfsense firewall?

See my brilliant paint for more explanation  ;D