Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT (Port Forwarding) and web failover

    Scheduled Pinned Locked Moved NAT
    27 Posts 4 Posters 9.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      skipper
      last edited by

      Hi marcelloc,
      virtual server: 192.168.100.100
      web:192.168.125.101
      web-slave:192.168.129.101
      I have a nat rule, source:wan address https, destination:192.168.100.100
      if i remove that how will it work?

      1 Reply Last reply Reply Quote 0
      • C Offline
        cpk
        last edited by

        skipper,

        I think that load balancing by definition has to use NAT, so creating a NAT rule manually would conflict with the automatically created settings used by load balancing.

        1 Reply Last reply Reply Quote 0
        • marcellocM Offline
          marcelloc
          last edited by

          @skipper:

          if i remove that how will it work?

          The virtual server will listen on wan interface ip.

          If you create a nat, the you will have two services "listening" on the same port/ip

          Create the virtual server and then create a wan rule to allow traffic to it with no nat.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • S Offline
            skipper
            last edited by

            i disabled the NAT rule and created 2 rules on the wan interface, first one destination wan address and the second one destination virtual server so i have not blocked package on the FW but still it doesn't work.
            from my vpn connection i can access the virtual server but not from internet so i am a bit confused :S
            do i need to setup something more?

            1 Reply Last reply Reply Quote 0
            • marcellocM Offline
              marcelloc
              last edited by

              Did you changed pfsense gui port and disabled WebGUI redirect to avoid conflict with your http redirect?

              Is 192.168.100.100 your wan address?

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • P Offline
                podilarius
                last edited by

                In your network, is the site-to-site a VPN or a point to point connection? They seem to be in different networks, so you are going to have to make sure that your routing and NAT reflect this.

                1 Reply Last reply Reply Quote 0
                • S Offline
                  skipper
                  last edited by

                  i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
                  how do i disable WebGUI redirection?
                  192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    skipper
                    last edited by

                    it's a vpn site-to-site. there is routing between the 2 networks so the web and web-slave can see each other. do i need an additional routing rule?

                    1 Reply Last reply Reply Quote 0
                    • marcellocM Offline
                      marcelloc
                      last edited by

                      @skipper:

                      i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
                      how do i disable WebGUI redirection?
                      192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

                      Create another virtual server with wan ip and it will work.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        skipper
                        last edited by

                        hey marcelloc thnx a lot, it's working!!
                        i cannot access the web-slave from internet but i can access it from web's network.
                        do i have to create some nat or routing about that?

                        1 Reply Last reply Reply Quote 0
                        • marcellocM Offline
                          marcelloc
                          last edited by

                          What status you have on loadbalance for the web-slave?

                          status -> loadbalancer

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            skipper
                            last edited by

                            the status is enable and accessible (green 100%) that's why i don't understand.

                            1 Reply Last reply Reply Quote 0
                            • S Offline
                              skipper
                              last edited by

                              i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

                              1 Reply Last reply Reply Quote 0
                              • marcellocM Offline
                                marcelloc
                                last edited by

                                @skipper:

                                i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

                                You will need an outbound nat to "masquerade" client internet ip. This way the server can return the package through vpn instead of forwarding it to it's wan

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • S Offline
                                  skipper
                                  last edited by

                                  thnx for your help marcelloc!!
                                  how must the outbound nat look?
                                  these are the vpn IPs
                                  pfsense1 ip : 10.4.0.1
                                  pfsense2 ip : 10.4.0.2

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM Offline
                                    marcelloc
                                    last edited by

                                    It's on firewall -> nat -> outbound

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • S Offline
                                      skipper
                                      last edited by

                                      i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
                                      here is my outbound nat rule

                                      Interface webslavelan
                                      Source      192.168.129.0/24
                                      Source Port   443
                                      Destination   10.4.0.0/30
                                      Destination Port *
                                      NAT Address *
                                      NAT Port   443
                                      Static Port   NO

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM Offline
                                        marcelloc
                                        last edited by

                                        @skipper:

                                        i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
                                        here is my outbound nat rule

                                        Interface webslavelan
                                        Source       192.168.129.0/24
                                        Source Port    443
                                        Destination    10.4.0.0/30
                                        Destination Port *
                                        NAT Address *
                                        NAT Port    443
                                        Static Port    NO

                                        change source to any.
                                        does webslavelan is the outgoing interface to reach 10.4.0.0/30?

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • S Offline
                                          skipper
                                          last edited by

                                          thnx for your help man!
                                          this is my network a bit more detailed,
                                          i have tried to put different interfaces and IPs on the outbound configuration but the traffic goes still to my wan :/
                                          now i put vpnsitetosite as interface and source any but it doesn't work.
                                          what should the destination be? is there something else that i need to define? create a new gateway or something like that?

                                          net.jpg
                                          net.jpg_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM Offline
                                            marcelloc
                                            last edited by

                                            Try to go to console and do some package capture to find what interface pfsense is using to send traffic to remote host.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.