Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwards from secondary double NAT gateway not working.

    NAT
    3
    27
    8.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kathampy
      last edited by

      @kejianshi:

      Yes - But on your two WAN interfaces, do those have gateways explicitly specified?

      "Make sure your WAN and WAN2 interfaces have a gateway selected on Interfaces > WAN/WAN2, not having a gateway selected on the Interface page will also make the system omit reply-to on the rules."

      WAN is PPPoE and uses a dynamic gateway. There is no option to select a gateway.
      LAN2 is an Ethernet interface with a static IP 10.1.0.1 and I have configured the gateway LAN2GW (10.1.0.2).

      My internet interfaces are WAN and LAN2. LAN2 services clients and has a backup NAT modem as well.

      1 Reply Last reply Reply Quote 0
      • K
        kathampy
        last edited by

        @kejianshi:

        I also think this is not quite right:

        "LAN2 uses LAN2GW"

        I don't think you should define a gateway on LAN2.
        I think you should handle where LAN2 packets exit to the web using which WAN in Firewall > NAT > Manual Outbound NAT

        I do not have a WAN2. I only have WAN and LAN1 & LAN2. I have already configured Manual Outbound NAT as follows:
        Interface: LAN2
        Source: LAN1 or 127.0.0.1
        Destination: !LAN2
        Translation Address: LAN2 address

        This way LAN1 to LAN2 is routed normally and LAN1 to Internet (via LAN2GW if any such policy based routing rules exist) get double NATed. This requires that I set LAN2GW as the gateway for the LAN2 interface.

        1 Reply Last reply Reply Quote 0
        • K
          kejianshi
          last edited by

          Actually, I think first, try to get outbound NAT sorted.

          I'm sure there are automatic rules that were generated telling everything to exit via WAN.

          Why not make a rule that tells LAN to use WAN
          and LAN2 to use your second WAN

          I really don't think you assign gateways to static IPs for LAN interfaces.

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            OK - Then I am definitely confused.  You only have one internet connection.  Is that correct?

            1 Reply Last reply Reply Quote 0
            • K
              kathampy
              last edited by

              @kejianshi:

              Actually, I think first, try to get outbound NAT sorted.

              I'm sure there are automatic rules that were generated telling everything to exit via WAN.

              Why not make a rule that tells LAN to use WAN
              and LAN2 to use your second WAN

              I really don't think you assign gateways to static IPs for LAN interfaces.

              Outbound NAT works fine for LAN1 via WAN, LAN1 via LAN2GW, LAN2 via WAN and LAN2 via LAN2GW. I don't have any automatic rules; they're all manual.

              1 Reply Last reply Reply Quote 0
              • K
                kathampy
                last edited by

                @kejianshi:

                OK - Then I am definitely confused.  You only have one internet connection.  Is that correct?

                No I have two. WAN is PPPoE. There is another backup connection on a NAT modem connected to the LAN2 switch. This modem is what I'm calling LAN2GW (10.1.0.2).

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  OK - I'm going to stop here then and just say that I think you have a broken topology.

                  I would try to get you to create 2 WAN interfaces on the pfsense box and let pfsense do all your routing for you for both networks and that way it could easily handle what you are trying to do, but I don't think I'd have much luck convincing you.

                  1 Reply Last reply Reply Quote 0
                  • K
                    kathampy
                    last edited by

                    @kejianshi:

                    OK - I'm going to stop here then and just say that I think you have a broken topology.

                    I would try to get you to create 2 WAN interfaces on the pfsense box and let pfsense do all your routing for you for both networks and that way it could easily handle what you are trying to do, but I don't think I'd have much luck convincing you.

                    It works fine this way. Any router does this out of the box.

                    My setup is basically single-WAN (WAN, LAN1 & LAN2) and all Internet connections go through WAN.

                    I have a second NAT modem on the LAN2 switch so that LAN2 clients can optionally use the NAT modem directly without pfSense.
                    As a backup I want to forward some ports from the NAT modem to pfSense. That's all.

                    1 Reply Last reply Reply Quote 0
                    • P
                      phil.davis
                      last edited by

                      I do this sort of thing in 1 place - use a network as a LAN and WAN at the same time. You can call it LAN2, WAN2, LWAN2, whatever you like - I will call it LWAN2. It is a subnet that has a gateway defined, so pfSense considers it a possible way out to other places (e.g. the internet) and you can policy-route whatever you like to the gateway. Clients can also be on that subnet, which is private behind the gateway device that NATs out to the internet. For me, I give those clients DHCP from pfSense with a default route to pfSense, then I NAT them in pfSense back out to the LWAN2 gateway. This makes all the traffic originated from LWAN2 clients be NATd as the LWAN2 pfSense IP. Then LWAN2 gateway will always send the return packets to pfSense, which will unNAT them and deliver to the LWAN2 clients. This ensures that pfSense sees the flows in both directions and there is no confusion about maintaining states. Enough of that - it is a valid and working setup for clients to initiate outbound states.
                      On the inbound, I have port forwards on the LWAN2 gateway to pfSense LWAN2 address. These are to an OpenVPN server on pfSense itself, so they are not on-forwarded inside LAN. That much works, so be encouraged :)
                      I haven't needed to forward again into a server on LAN, so not sure what the extra trick will be to get that to reply back on the correct route.

                      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                      1 Reply Last reply Reply Quote 0
                      • K
                        kejianshi
                        last edited by

                        OK - Good.  I'm glad it works for you, but I can't understand why it would work.
                        I understand 2 WAN or more > pfsense and lots of options.
                        I don't understand 1 WAN > pfsense > 2 LANS and 1 of those LANs into a switch attached to a switch thats attached to the LAN side of another router/modem.

                        I'll watch to see what some of the more knowledgeable people come up with.  I couldn't make that work.

                        1 Reply Last reply Reply Quote 0
                        • K
                          kathampy
                          last edited by

                          @phil.davis:

                          I do this sort of thing in 1 place - use a network as a LAN and WAN at the same time. You can call it LAN2, WAN2, LWAN2, whatever you like - I will call it LWAN2. It is a subnet that has a gateway defined, so pfSense considers it a possible way out to other places (e.g. the internet) and you can policy-route whatever you like to the gateway. Clients can also be on that subnet, which is private behind the gateway device that NATs out to the internet. For me, I give those clients DHCP from pfSense with a default route to pfSense, then I NAT them in pfSense back out to the LWAN2 gateway. This makes all the traffic originated from LWAN2 clients be NATd as the LWAN2 pfSense IP. Then LWAN2 gateway will always send the return packets to pfSense, which will unNAT them and deliver to the LWAN2 clients. This ensures that pfSense sees the flows in both directions and there is no confusion about maintaining states. Enough of that - it is a valid and working setup for clients to initiate outbound states.
                          On the inbound, I have port forwards on the LWAN2 gateway to pfSense LWAN2 address. These are to an OpenVPN server on pfSense itself, so they are not on-forwarded inside LAN. That much works, so be encouraged :)
                          I haven't needed to forward again into a server on LAN, so not sure what the extra trick will be to get that to reply back on the correct route.

                          This is exactly what I do. I am able to policy route through LAN2GW to the Internet. All combinations of outbound work fine including non-NATed LAN1 to LAN2.

                          However in my case I am not even able to access pfSense's local services from the Internet when port forwarded from LAN2GW. I'm not able to access the web UI or SSH from LAN2GW port forwards. If I change the default gateway to LAN2GW the port forwards start working.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kathampy
                            last edited by

                            @kejianshi:

                            OK - Good.  I'm glad it works for you, but I can't understand why it would work.
                            I understand 2 WAN or more > pfsense and lots of options.
                            I don't understand 1 WAN > pfsense > 2 LANS and 1 of those LANs into a switch attached to a switch thats attached to the LAN side of another modem.

                            I'll watch to see what some of the more knowledgeable people come up with.  I couldn't make that work.

                            It won't work unless you manually define outbound NAT rules. pfSense will NOT create outbound NAT rules if you simply set a gateway on LAN2. The rule should also exclude LAN1 to LAN2 traffic from being NATed.

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi
                              last edited by

                              I'm not arguing - I'm watching.
                              Ill be shocked and amazed if it works, but if it does I'll have learned something new.
                              Looks like phil.davis has done this before, so you are in luck.  I'll just watch and learn.

                              1 Reply Last reply Reply Quote 0
                              • P
                                phil.davis
                                last edited by

                                It won't work unless you manually define outbound NAT rules. pfSense will NOT create outbound NAT rules if you simply set a gateway on LAN2.

                                Correct - basically when you add a gateway to an interface, pfSense treats that as a WAN for the purpose of generating automatic goodies - so if you give (what happens to be called) LAN2 a gateway, then I expect the automatic outbound NAT will make outbound NAT rules from LAN to WAN and LAN to LAN2 (treating LAN2 as another WAN). But it won't be able to 2nd-guess you and make outbound NAT rules from LAN2 to anywhere.
                                As KurianOfBorg says, once you get the necessary manual outbound NAT rules defined, all the outbound client connections work fine.
                                But I am struggling to think what might be happening to the incoming port forwards. If I get a chance I'll try it out on my Alix at home, I have 2 ISPs, 3 physical ports and can make ordinary LAN, primary wired ISP on WAN and a "LWAN2" that has other clients and a way out to the internet via a 2nd ISP on a NATd 3G device.

                                As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kathampy
                                  last edited by

                                  @kejianshi:

                                  I'm not arguing - I'm watching.
                                  Ill be shocked and amazed if it works, but if it does I'll have learned something new.
                                  Looks like phil.davis has done this before, so you are in luck.  I'll just watch and learn.

                                  Another interesting fact is at the remote location, if I don't use a NAT router and use a remote PC with a public IP address instead, I am able to connect to the port forwards on LAN2GW and the response packets are coming from WAN's public IP address! You'd think the socket implementation on the OS would see the tuple is mismatched but the return packets are still arriving via a different route. A NAT router at the remote location would discard these packets, but Windows with a public IP address is not.

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    kejianshi
                                    last edited by

                                    This is interesting to me, assuming you get it to work, because someone was before trying to do something else I didn't think was very probable.  Trying to run a Openvpn server at end 1.  Send a vpn client config to end 2.  Then have pfsense on end 1 be able to grab an IP at end 2 and NAT that public IP to all computers attached to pfsense at end 1 such that those computers at end 1 were surfing the web using end 2's public IP.  (VPN in reverse)

                                    As I said, I don't understand how this will work not having done it, but as with your scenario my first thought is "that shouldn't work".
                                    But, I'm wrong abit, so if it does work thats cool.  I'll have learned something.

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kathampy
                                      last edited by

                                      @phil.davis:

                                      As KurianOfBorg says, once you get the necessary manual outbound NAT rules defined, all the outbound client connections work fine.
                                      But I am struggling to think what might be happening to the incoming port forwards.

                                      Actually, servers do not even need any kind of outbound firewall rules. Simply forwarding a port from any WAN* interface to a LAN server will allow the server to communicate with the remote client. This works fine if I configure two interfaces WAN1 and WAN2 with public IP addresses. I am able to connect remotely through a WAN2 port forward even though WAN1 is the default gateway and even when there are no outbound firewall rules at all. Only the outbound NAT rule for WAN2 is required.

                                      This fails when WAN2 is a double NAT (in my case the LAN2 interface with LAN2GW manually set).

                                      Can you show me your port forward rule and the associated firewall rule and maybe the outbound NAT rule as well? Did you have to set the gateway explicitly on the associated firewall rule? I am not able to get this working even for local services on pfSense's LAN2 address where the only port forward is on the NAT modem to pfSense's LAN2 address.

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kathampy
                                        last edited by

                                        I found the problem. Even though the inbound rules were defined on the LAN2 interface, the responses were using the policy based routing rule on my LAN interface group rule for "*** to * through WAN gateway**". The associated firewall rules on LAN2 from the NAT port forward were not being used at all. I changed the LAN interface group rule to "LAN1/LAN2 to * through WAN gateway" so that it doesn't match the packets being forwarded by the NAT modem.

                                        Now I am able to port forward to both pfSense as well as to LAN1 servers from the NAT modem on LAN2.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.