Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VIP/NAT help please!!

    Scheduled Pinned Locked Moved
    HA/CARP/VIPs
    4
    13
    4.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      podilarius
      last edited by

      If you are going to continue with that setup, you would make them ProxyARP.

      1 Reply Last reply Reply Quote 0
      • L
        luke240778
        last edited by

        I have no choice but to continue with that setup i guess as thats the ISP's way of doing things..

        So ProxyARP.. do i create a single entry per IP or just 1 for the Block?

        1 Reply Last reply Reply Quote 0
        • P
          podilarius
          last edited by

          @luke240778:

          I have no choice but to continue with that setup i guess as thats the ISP's way of doing things..

          So ProxyARP.. do i create a single entry per IP or just 1 for the Block?

          Proxy ARP are best done as /32, or one per IP. IMO.

          1 Reply Last reply Reply Quote 0
          • L
            luke240778
            last edited by

            Ok, i have created ProxyARP VIP's.. created 1 entry per ip rather than the whole block. That part is not too dificult, its the next part that i can never undertand or get to work..

            I dont know if now to use one of these VIP's as the public IP for my server, do i need to Port Forward it to the server LAN ip?  Nat? 1:1? I have no idea, have tried them all and cant get it to work

            1 Reply Last reply Reply Quote 0
            • D
              dhatz
              last edited by

              @podilarius:

              @luke240778:

              So ProxyARP.. do i create a single entry per IP or just 1 for the Block?

              Proxy ARP are best done as /32, or one per IP. IMO.

              Why do you think that Proxy ARP VIPs are best done as /32?

              If he defined the /28 block, pfsense will expand it to a list of 16 IPs and make them individually available in the NAT port-forward section.

              1 Reply Last reply Reply Quote 0
              • L
                luke240778
                last edited by

                @dhatz:

                @podilarius:

                @luke240778:

                So ProxyARP.. do i create a single entry per IP or just 1 for the Block?

                Proxy ARP are best done as /32, or one per IP. IMO.

                Why do you think that Proxy ARP VIPs are best done as /32?

                If he defined the /28 block, pfsense will expand it to a list of 16 IPs and make them individually available in the NAT port-forward section.

                Ahh.. in that case, i can just add the block of IP's in the VIP section, then do i need to create 1:1 NAT entries for each ip to go to a certain machine? (to use as public IP for servers for example)

                1 Reply Last reply Reply Quote 0
                • P
                  podilarius
                  last edited by

                  @dhatz:

                  @podilarius:

                  @luke240778:

                  So ProxyARP.. do i create a single entry per IP or just 1 for the Block?

                  Proxy ARP are best done as /32, or one per IP. IMO.

                  Why do you think that Proxy ARP VIPs are best done as /32?

                  If he defined the /28 block, pfsense will expand it to a list of 16 IPs and make them individually available in the NAT port-forward section.

                  So that you can dynamically use them. If you assign them all at once, you cannot use (even as a test) another device in front of the firewall. Could potentially be a security concern if you are not actively using the IP it will still reference the firewall. there could be a bug, or if there is not one, one could develop in an upgrade, that could allow someone access. human error can also bite you.

                  1 Reply Last reply Reply Quote 0
                  • L
                    luke240778
                    last edited by

                    So guys, i have read all these posts, played with it.. read the pfSense book on NAT and VIP's but still can't get it to work.. Here is a simple scenario of what i want and hopefuly someone can give me a step by step that works:

                    To test i want to setup a XP box i  have on my OPT1 so i can RDP to it using one of my Public IP's..

                    Current WAN IP: 189.53.100.10
                    Public IP Block: 201.73.17.176/28
                    Assign IP to XP: 201.73.17.178
                    XP Lan IP: 192.168.5.28

                    I will do similar with servers but if i can just get the how to for this i can then apply that to the rest.

                    Hoping someone can assist..

                    1 Reply Last reply Reply Quote 0
                    • pttP
                      ptt Rebel Alliance
                      last edited by

                      From your XP box web browser, if you go to http://pfsense.org/ip.php  wihich IP you see ?

                      1 Reply Last reply Reply Quote 0
                      • P
                        podilarius
                        last edited by

                        Did you use port forward or 1:1 NAT? If you are using port forward, then you will need to use advanced outbound NAT (manual mode) to transform the outgoing ip to 201.73.17.178. Remember that it is first matching rule in AON so if your LAN rule is above your custom outbound, then the custom outbound will never happen.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post