Outbound NAT - Newbie Question

fraggle

thanks for the reply…

Firewall-LAN.jpg_thumb

Firewall-WAN.jpg_thumb

NAT-In.jpg_thumb

Nat-out.jpg_thumb

jimp

You have to be on manual outbound NAT, if you aren't already. Can't tell from the screenshots.

Also, the source port shouldn't be 25, it should be 'any'.

jmcvay

Fraggle,

Did you resolve your issue? I have an interface dedicated for Wireless Traffic, and would like to route that traffic out of a different WAN IP than our LAN uses and have been looking for solutions. Single WAN, multiple addresses though.

Using pfSense 2.0-RC1 with AON

stony999

I have the same problem.

I have IPs from my ISP starting from xxx.xxx.xxx.186 to xxx.xxx.xxx.190. The IP adresses xxx.xxx.xxx.187 - xxx.xxx.xxx.190 are defined as virtual IPs.
I have created 2 outbound NAT rules in order to have all SIP traffic from 2 IPs in the LAN routed via the external IP xxx.xxx.xxx.189. However this traffic is still going via xxx.xxx.xxx.186.
I also created another rule which generally sets the outgoing IP for all traffic from the LAN (192.168.178.0/24) via xxx.xxx.xxx.187. However even this traffic is still going via xxx.xxx.xxx.186.
I cross-checked the traffic on another external server. The sending IP is in fact xxx.xxx.xxx.186.

So outgoing IP mapping does not seem to work on my machine on virtual WAN IPs. (incoming NAT is no problem by the way)

Anybody has a hint how to solve this?

pfsense_outg-nat.png_thumb

jimp

If outbound NAT isn't working like you expect, odds are that the rules are not matching like you expect them to. Try changing the last rule to a VIP and see if it catches it.

stony999

The IP (xxx.xxx.xxx.187) in the last rule in fact is a VIP. I did this for testing, to see if it generally works.
But the outgoing IP is always xxx.xxx.xxx.186.

jimp

Switch back to automatic outbound NAT, and then back to Manual, and clean up the extra rules that come back, and try it again.

Also, make sure you are on a current snapshot (From July 11 or newer)

stony999

The system is on Pfsense 1.2.3

jimp

Sorry, got you confused with the previous poster in the thread that said they were on 2.0, and you didn't specify. Same advice still applies.

stony999

I did as you proposed:

Automatic outbound NAT rule generation (IPsec passthrough)
Manual Outbound NAT rule generation (Advanced Outbound NAT (AON))
then I deleted the additional rule which was added
so I am at the state again as in the screenshot above

But outgoing traffic is still on xxx.xxx.xxx.186 and not on the virtual IP.

For 1.2.3 there isn't a snapshot available, right?

Maybe I should mention that pfsense is running inside a KVM container with PromoxVE.
Therefore I did a ngrep on the traffic on all interfaces of the physical hosts (physical IF and bridged IF). But outgoing traffic is always on xxx.xxx.xxx.186 on all interfaces. So pfsense seems not to try to assign the VIP.
Incoming traffic on VIPs xxx.xxx.xxx.187-190 works nicely.