Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Outbout NAT At My Limit

    Scheduled Pinned Locked Moved NAT
    17 Posts 3 Posters 3.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Sabyre
      last edited by

      I just checked again … if I switch it to a /32 I can't even access the server. times out.

      "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

      1 Reply Last reply Reply Quote 0
      • S
        Sabyre
        last edited by

        It seems the only way around this would be to turn the LAN into a VLAN, which I'm a bit concerned about considering we have a IPsec tunnel setup for the LAN.

        "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

        1 Reply Last reply Reply Quote 0
        • S
          Sabyre
          last edited by

          Just want to make sure I am understanding this correctly….

          Looking at the attached pic:

          1 = Interface packet is leaving
          2 = Packets origin
          3 = Packets destination
          4 = Mask the identity of the packets origin with

          Perhaps this can't work over local considering im asking it to mask with an external ip.

          onat1.jpg
          onat1.jpg_thumb

          "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

          1 Reply Last reply Reply Quote 0
          • S
            Sabyre
            last edited by

            Anyone?

            "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

            1 Reply Last reply Reply Quote 0
            • S
              Sabyre
              last edited by

              I was hoping someone could at least confirm my logic with that attached picture above.

              Perhaps the best thing would be for me to pay for the support and go that route.

              "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

              1 Reply Last reply Reply Quote 0
              • V
                vindenesen
                last edited by

                @Sabyre:

                I was hoping someone could at least confirm my logic with that attached picture above.

                Your logic is hereby confirmed :) The picture looks good!

                Support the project by buying a Gold Subscription at https://portal.pfsense.org
                Running pfSense on SuperMicro A1SRI-2758F with ESXi 5.5

                1 Reply Last reply Reply Quote 0
                • S
                  Sabyre
                  last edited by

                  Thank you sir!  ;D

                  "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    You did clear states after making changes but before testing right?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Sabyre
                      last edited by

                      Yes of course.

                      Issue seems to be; with the vlans I can select the specific public IP, but with the LAN I can only select 'interface address' which would reflect a local, a vlan public which would be incorrect or a specified subnet. Choosing specified subnet 'xxx.xxx.xxx.xxx/32' doesn't work and /29 reflects an ip just below the gateway? .248 whereas the gateway is .249

                      "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Wait a minute.

                        You want connections from LAN to VLAN to appear to be coming from 24.39.20.250?

                        To what interface is that VIP assigned?

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • S
                          Sabyre
                          last edited by

                          Yes,

                          That's just it, it's the only public IP that is not VIP. It is assigned to the WAN

                          "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            I'm not sure how you expect to NAT an address that isn't assigned to either of the interfaces involved in carrying the traffic.

                            That seems pretty convoluted to me and I'm not surprised it's not behaving as you think it should.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • S
                              Sabyre
                              last edited by

                              Workstation on LAN accesses Webserver on VLAN by way of domain.com, dns call goes out to determine IP of domain.com = 24.111.111.111.
                              Server should think request is from IP 24.111.111.110 (pub IP of LAN).

                              Perhaps this should be accomplished with a static route?

                              "We are the music makers and we are the dreamers of the dreams" - Willy Wonka

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.