Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT from external works great.. internal.. bad?

    Scheduled Pinned Locked Moved
    NAT
    2
    7
    3.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      key4ce
      last edited by

      Hello,

      Well i got a strange problem.. everything external seems to work perfect..
      However from for example my laptop to a Webserver thats located within the lan: FTP can not view files (stuck at binary connection)
      HTTPS: seems to load but then states "connection interupted" 
      HTTP: Runs fine.

      Now i got multiple IP's on a single WAN
      their setup as IP Aliases

      i got my own private public ip subnet of 8 ips.

      Aliases all seem fine from outside.. however from within the local lan i think the routing goes horrably wrong.

      The rule for example:
      [All traffic matching this NAT entry is passed] WAN TCP/UDP * * 88.159.83.165 Web1_TCP_UDP 192.168.0.52 *

      where 88.159.83.165 is the public IP Alias set under Dest. addr.
      192.168.0.52 is the local webserver.

      Web1_TCP_UDP got port 443 , 80 etc etc.. so HTTPS should technically work fine…
      from external: can load https site (https://key4ce.com) fine.
      and can load http site (http://key4ce.com)  fine.

      From internal with laptop: can't load https and CAN load http.
      https complains about being interupted (it starts loading then suddenly stops)

      this is from multiple internal pc's.

      I got Manual Outbound NAT rule generation
                (AON - Advanced Outbound NAT)
      turned on.. i am not sure if thats related to this issue.
      (the reason why it's turned on is because we got services like VOIP that need to register under an alias ip on external SIP's. and not under the default WAN ip)

      Does anyone have any idea on where i should look next? or what my misconfiguration is?

      Regards,
      Marco

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        http://doc.pfsense.org/index.php/Why_can%27t_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks%3F

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • K
          key4ce
          last edited by

          I already seen that one..
          I used method 1: NAT Reflection.
          those rules are set to reflect and it's unchecked in advanced settings. (this is why HTTP works for example.. it only seems to cut off some services and allow others fine)

          DNS Method is not possible as we host over 1000 domains where we should be able to connect to from local when needed (for example FTP that doesn't function)

          I also got the LAN Rules as pdf describes and outbound (last one for all internal 192.168.0.0/24) all setup.

          i think the supprising part is that i get interupted..
          FTP is also logging in first.. then stops at Binary DATA protocol.
          HTTPS loads for few seconds then suddenly stops and says interupted.

          Is there any protocol or option inside pfSense that interupts or time-out connections within a few seconds?

          Regards,
          Marco

          PS: thanks for the quick reply!

          1 Reply Last reply Reply Quote 0
          • GruensFroeschliG
            GruensFroeschli
            last edited by

            How many NAT reflects are you talking about?
            Just since you say you host over 1000 domains….

            NAT reflection will not start if you forward ranges >500 and/or more than 1000 reflects in total.

            We do what we must, because we can.

            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

            1 Reply Last reply Reply Quote 0
            • K
              key4ce
              last edited by

              not more then 1000 reflects in total?
              i did read about the not larger then 500 ports (this is probably the problem for FTP as it's passive with dynamic port range)
              which is not that big of a deal as revising FTP server was the next on the list (after changing firewall.. we used to have ipcop before this.. pfsense freebsd based is alot more to our likings :))

              is there anyway to manually add simular reflect rules?
              for example to force https to work?

              1 Reply Last reply Reply Quote 0
              • K
                key4ce
                last edited by

                Alright..
                just to test i modified the ranged ports to be seperated (and not reflected) instead of inside alias and reflected.
                i didn't specifically count it all but i am very sure it isn't 1000 reflections.

                however.. HTTPS still doesn't work..
                is there any option that prevents https to work on a ALIAS IP?
                Lockout mode is disabled (tho that should only mostly matter to WAN main ip)

                Regards,
                Marco

                1 Reply Last reply Reply Quote 0
                • K
                  key4ce
                  last edited by

                  Well.. after screwing around for several days.. still no real luck on getting this done the right way…
                  To bad.. cause i really liked all functions.. but really.. their useless if their not reachable by local LAN and only External people.

                  So we went looking for other projects.. ended up with Endian where this problem is solved by 4 clicks:

                  Source nat (outbound) tab:
                  Source: 192.168.0.0/24
                  Destination (interface): GREEN
                  NAT to: Auto
                  (the last one is normally the external ip for all other outbound rules)

                  So for a future request: please add something similar or effective for inbound traffic.
                  As in the end.. clusters.. clouds..Active directory and actually nearly every service these days should be DNS based.. which no one with a larger network will split up with inbound and outbound dns etc etc and most functions of PFsense --> ARE for larger networks so this is kind of a real miss if you ask me.

                  Regards,
                  Marco

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post