Port forwards from secondary double NAT gateway not working.
-
Its funny you should ask…
http://forum.pfsense.org/index.php/topic,60537.0/topicseen.html
They talk about NAT forwarding off two WANs and gateway address requirements.
I have already set the gateway on LAN2 to LAN2GW and configured NAT rules for LAN2 as follows:
Source: LAN1 subnet or 127.0.0.1
Destination: !LAN2 subnetI am able to browse the Internet using LAN2GW from LAN1 clients using policy based routing. It's the incoming port forwards thats the problem. If I change the default gateway to LAN2GW then port forwards work. It's seems like a "reply-to" problem.
Everything works fine with direct public interfaces WAN1 and WAN2.
-
I'd imagine when double NATed for the second wan, you would get an IP like 192.168.1.2 and have to stipulate a gateway address of something like 192.168.1.1 (not the gateway address the ISP gave you because you want to use the router as the gateway). Thats my guess.
-
I'd imagine when double NATed for the second wan, you would get an IP like 192.168.1.2 and have to stipulate a gateway address of something like 192.168.1.1 (not the gateway address the ISP gave you because you want to use the router as the gateway). Thats my guess.
Yes thats exactly what I've done. LAN1 is 10.0.0.0/16 and LAN2 is 10.1.0.0/16. LAN1 has no gateway since by defauly it uses WAN. LAN2 uses LAN2GW (the NAT modem 10.1.0.2).
Like I said I am able to browse the Internet through LAN2GW from LAN1 using policy based routing.
-
Yes - But on your two WAN interfaces, do those have gateways explicitly specified?
"Make sure your WAN and WAN2 interfaces have a gateway selected on Interfaces > WAN/WAN2, not having a gateway selected on the Interface page will also make the system omit reply-to on the rules."
-
I also think this is not quite right:
"LAN2 uses LAN2GW"
I don't think you should define a gateway on LAN2.
I think you should handle where LAN2 packets exit to the web using which WAN in Firewall > NAT > Manual Outbound NAT -
Yes - But on your two WAN interfaces, do those have gateways explicitly specified?
"Make sure your WAN and WAN2 interfaces have a gateway selected on Interfaces > WAN/WAN2, not having a gateway selected on the Interface page will also make the system omit reply-to on the rules."
WAN is PPPoE and uses a dynamic gateway. There is no option to select a gateway.
LAN2 is an Ethernet interface with a static IP 10.1.0.1 and I have configured the gateway LAN2GW (10.1.0.2).My internet interfaces are WAN and LAN2. LAN2 services clients and has a backup NAT modem as well.
-
I also think this is not quite right:
"LAN2 uses LAN2GW"
I don't think you should define a gateway on LAN2.
I think you should handle where LAN2 packets exit to the web using which WAN in Firewall > NAT > Manual Outbound NATI do not have a WAN2. I only have WAN and LAN1 & LAN2. I have already configured Manual Outbound NAT as follows:
Interface: LAN2
Source: LAN1 or 127.0.0.1
Destination: !LAN2
Translation Address: LAN2 addressThis way LAN1 to LAN2 is routed normally and LAN1 to Internet (via LAN2GW if any such policy based routing rules exist) get double NATed. This requires that I set LAN2GW as the gateway for the LAN2 interface.
-
Actually, I think first, try to get outbound NAT sorted.
I'm sure there are automatic rules that were generated telling everything to exit via WAN.
Why not make a rule that tells LAN to use WAN
and LAN2 to use your second WANI really don't think you assign gateways to static IPs for LAN interfaces.
-
OK - Then I am definitely confused. You only have one internet connection. Is that correct?
-
Actually, I think first, try to get outbound NAT sorted.
I'm sure there are automatic rules that were generated telling everything to exit via WAN.
Why not make a rule that tells LAN to use WAN
and LAN2 to use your second WANI really don't think you assign gateways to static IPs for LAN interfaces.
Outbound NAT works fine for LAN1 via WAN, LAN1 via LAN2GW, LAN2 via WAN and LAN2 via LAN2GW. I don't have any automatic rules; they're all manual.
-
OK - Then I am definitely confused. You only have one internet connection. Is that correct?
No I have two. WAN is PPPoE. There is another backup connection on a NAT modem connected to the LAN2 switch. This modem is what I'm calling LAN2GW (10.1.0.2).
-
OK - I'm going to stop here then and just say that I think you have a broken topology.
I would try to get you to create 2 WAN interfaces on the pfsense box and let pfsense do all your routing for you for both networks and that way it could easily handle what you are trying to do, but I don't think I'd have much luck convincing you.
-
OK - I'm going to stop here then and just say that I think you have a broken topology.
I would try to get you to create 2 WAN interfaces on the pfsense box and let pfsense do all your routing for you for both networks and that way it could easily handle what you are trying to do, but I don't think I'd have much luck convincing you.
It works fine this way. Any router does this out of the box.
My setup is basically single-WAN (WAN, LAN1 & LAN2) and all Internet connections go through WAN.
I have a second NAT modem on the LAN2 switch so that LAN2 clients can optionally use the NAT modem directly without pfSense.
As a backup I want to forward some ports from the NAT modem to pfSense. That's all. -
I do this sort of thing in 1 place - use a network as a LAN and WAN at the same time. You can call it LAN2, WAN2, LWAN2, whatever you like - I will call it LWAN2. It is a subnet that has a gateway defined, so pfSense considers it a possible way out to other places (e.g. the internet) and you can policy-route whatever you like to the gateway. Clients can also be on that subnet, which is private behind the gateway device that NATs out to the internet. For me, I give those clients DHCP from pfSense with a default route to pfSense, then I NAT them in pfSense back out to the LWAN2 gateway. This makes all the traffic originated from LWAN2 clients be NATd as the LWAN2 pfSense IP. Then LWAN2 gateway will always send the return packets to pfSense, which will unNAT them and deliver to the LWAN2 clients. This ensures that pfSense sees the flows in both directions and there is no confusion about maintaining states. Enough of that - it is a valid and working setup for clients to initiate outbound states.
On the inbound, I have port forwards on the LWAN2 gateway to pfSense LWAN2 address. These are to an OpenVPN server on pfSense itself, so they are not on-forwarded inside LAN. That much works, so be encouraged :)
I haven't needed to forward again into a server on LAN, so not sure what the extra trick will be to get that to reply back on the correct route. -
OK - Good. I'm glad it works for you, but I can't understand why it would work.
I understand 2 WAN or more > pfsense and lots of options.
I don't understand 1 WAN > pfsense > 2 LANS and 1 of those LANs into a switch attached to a switch thats attached to the LAN side of another router/modem.I'll watch to see what some of the more knowledgeable people come up with. I couldn't make that work.
-
I do this sort of thing in 1 place - use a network as a LAN and WAN at the same time. You can call it LAN2, WAN2, LWAN2, whatever you like - I will call it LWAN2. It is a subnet that has a gateway defined, so pfSense considers it a possible way out to other places (e.g. the internet) and you can policy-route whatever you like to the gateway. Clients can also be on that subnet, which is private behind the gateway device that NATs out to the internet. For me, I give those clients DHCP from pfSense with a default route to pfSense, then I NAT them in pfSense back out to the LWAN2 gateway. This makes all the traffic originated from LWAN2 clients be NATd as the LWAN2 pfSense IP. Then LWAN2 gateway will always send the return packets to pfSense, which will unNAT them and deliver to the LWAN2 clients. This ensures that pfSense sees the flows in both directions and there is no confusion about maintaining states. Enough of that - it is a valid and working setup for clients to initiate outbound states.
On the inbound, I have port forwards on the LWAN2 gateway to pfSense LWAN2 address. These are to an OpenVPN server on pfSense itself, so they are not on-forwarded inside LAN. That much works, so be encouraged :)
I haven't needed to forward again into a server on LAN, so not sure what the extra trick will be to get that to reply back on the correct route.This is exactly what I do. I am able to policy route through LAN2GW to the Internet. All combinations of outbound work fine including non-NATed LAN1 to LAN2.
However in my case I am not even able to access pfSense's local services from the Internet when port forwarded from LAN2GW. I'm not able to access the web UI or SSH from LAN2GW port forwards. If I change the default gateway to LAN2GW the port forwards start working.
-
OK - Good. I'm glad it works for you, but I can't understand why it would work.
I understand 2 WAN or more > pfsense and lots of options.
I don't understand 1 WAN > pfsense > 2 LANS and 1 of those LANs into a switch attached to a switch thats attached to the LAN side of another modem.I'll watch to see what some of the more knowledgeable people come up with. I couldn't make that work.
It won't work unless you manually define outbound NAT rules. pfSense will NOT create outbound NAT rules if you simply set a gateway on LAN2. The rule should also exclude LAN1 to LAN2 traffic from being NATed.
-
I'm not arguing - I'm watching.
Ill be shocked and amazed if it works, but if it does I'll have learned something new.
Looks like phil.davis has done this before, so you are in luck. I'll just watch and learn. -
It won't work unless you manually define outbound NAT rules. pfSense will NOT create outbound NAT rules if you simply set a gateway on LAN2.
Correct - basically when you add a gateway to an interface, pfSense treats that as a WAN for the purpose of generating automatic goodies - so if you give (what happens to be called) LAN2 a gateway, then I expect the automatic outbound NAT will make outbound NAT rules from LAN to WAN and LAN to LAN2 (treating LAN2 as another WAN). But it won't be able to 2nd-guess you and make outbound NAT rules from LAN2 to anywhere.
As KurianOfBorg says, once you get the necessary manual outbound NAT rules defined, all the outbound client connections work fine.
But I am struggling to think what might be happening to the incoming port forwards. If I get a chance I'll try it out on my Alix at home, I have 2 ISPs, 3 physical ports and can make ordinary LAN, primary wired ISP on WAN and a "LWAN2" that has other clients and a way out to the internet via a 2nd ISP on a NATd 3G device. -
I'm not arguing - I'm watching.
Ill be shocked and amazed if it works, but if it does I'll have learned something new.
Looks like phil.davis has done this before, so you are in luck. I'll just watch and learn.Another interesting fact is at the remote location, if I don't use a NAT router and use a remote PC with a public IP address instead, I am able to connect to the port forwards on LAN2GW and the response packets are coming from WAN's public IP address! You'd think the socket implementation on the OS would see the tuple is mismatched but the return packets are still arriving via a different route. A NAT router at the remote location would discard these packets, but Windows with a public IP address is not.