Accessing WAN's public IP from the LAN not working. Please help.

MediocreFred · Jul 28, 2011, 3:15 PM

Hello,

I've been using pfSense for at least 4 years and have never got the following scenario to work. It has never really been a big issue, but, now, I would like to get it to work. Am currently on pfSense 2.0 RC3.

I have 3 interfaces - WAN, LAN and WirelessLAN (WLAN).

The WAN has a public IP of 50.xx.xx.xx and a name using dyndns.

One of the servers on the LAN runs a few web applications. Required port forward and firewall rules have been setup to allow these applications to be accessed from the outside (using for instance, http://xxx.gotdns.org:44444) and from the inside using the internal IP of the server.

I have never been able to get the http://xxx.gotdns.org:44444 to work from any PC on the LAN or the WLAN. Substituting the name with the public WAN IP does not work either. Nothing gets logged when I attempt this access.

I would really like to be able to access the same url both internally and externally. Can anybody please explain why this is not working and suggest a solution.

Thanks in advance!
-MediocreFred.

jimp · Jul 28, 2011, 3:22 PM

http://doc.pfsense.org/index.php/Why_can%27t_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks%3F

MediocreFred · Jul 28, 2011, 3:49 PM

Thanks jimp! It was right there the entire time and I missed it (the documentation)! I feel so stupid.

Method 1 (unchecking Disable NAT Reflection) worked perfectly for me. Wow!

Reading through the other options on the page, Split DNS sounds like a cleaner/purer solution, but, I have multiple servers on the LAN that need to be accessed. Currently, I use the same external name, but, with different ports. The NAT translation / port forwarding configuration specifies the correct server for each forwarded port. If my understanding is correct, in order to get Split DNS to work, I'll need a separate DynDNS hostname for each server on the LAN that needs to be accessed. Is this correct?

For the time being though, NAT Reflection is working as desired. Are there any ill-effects with leaving this enabled?

Thanks!

jimp · Jul 28, 2011, 3:53 PM

NAT reflection works fine … except when it doesn't. :-)

It's usually all or nothing, so if it works, keep using it, you're probably fine.

For split DNS, yes, you'd need a separate hostname for each server on your LAN.

MediocreFred · Jul 29, 2011, 3:29 PM

Thanks again jimp.

I'll leave NAT reflection enabled for now. Working like a charm so far!

Thanks,
MediocreFred.

Dave2007 · Nov 20, 2011, 9:44 PM

The following setup seems to work for me (using pfSense 2.0):

WAN IP: 1.2.3.4
LAN (10.10.x.x)
OPT (10.20.x.x)

NAT-Reflection is off.
On the OPT Interface of pfSense I have a Virtual IP (of type ProxyARP) with the same address as the WAN interface (1.2.3.4).
I have port forward rules from WAN to LAN and the same port forward rules from OPT to LAN (using the Virtual IP from above).

Now a web server on LAN can be accessed using the same IP address (http://1.2.3.4:80) equally from the WAN-Network as from the OPT-Network.

Is there anything wrong or dangerous with this setup? As I said, it does work at the moment.

Thanks for your answers!