Basic out-going NAT isn't working
-
So as I asked the OP, lets see your state stable showing these unchanged IPs and lets see your nat table. There rarely is a reason to use manual if you ask me. What did you think you required manual natting outbound for?
-
I use manual NAT for Multi-WAN and a OVPN Interface.
-
So ok, lets see these states where your not changing the outbound IP and your outbound nat rules.. Without some info to work from, its just PEBKAC sorry ;)
"NAT doesn't work anymore."
Do you take your car to the mech and just say it doesn't work anymore ;) Do you go to the doc and when he asks whats wrong - "I'm Sick"
-
Sorry for the poor information. My english is cruel.
It is very complicated for me to detail to write in english.
It is easier for me if you tell me by what and how I look and I'll tell you what comes out, ok ?
One in advance … the command "pfctl -s state" brings an empty result, the firewall-log is empty
-
so this is empty?
[2.1.5-RELEASE][root@pfsense.local.lan]/root(3): pfctl -s state
vmx3f0 ipv6 24.13.xx.xx -> 184.105.253.14 MULTIPLE:MULTIPLE
vmx3f0 ipv6-icmp ff02::1[192] <- fe80::201:5cff:fe66:4046 NO_TRAFFIC:NO_TRAFFIC
gif0 ipv6-icmp 2001:470:xxx:9c4::2[51329] -> 2001:470:xxx:9c4::1 NO_TRAFFIC:NO_TRAFFIC
vmx3f2 tcp 17.110.224.14:443 <- 192.168.2.230:56975 ESTABLISHED:ESTABLISHED
vmx3f0 tcp 192.168.2.230:56975 -> 24.13.xx.xx:1609 -> 17.110.224.14:443 ESTABLISHED:ESTABLISHED
vmx3f0 ipv6-icmp ff02::1 <- fe80::201:5cff:fe66:4046 NO_TRAFFIC:NO_TRAFFIC
vmx3f1 tcp 70.37.56.25:443 <- 192.168.1.100:26456 ESTABLISHED:ESTABLISHED
<snipped rest="" of="" output="">Then you got NOTHING going through your pfsense if you have no STATES!! Did you turn off nat and firewalling and just using it as a router?</snipped> -
what can I say … :-\
/root(5): pfctl -s state
/root(6):
-
Is traffic flowing through the firewall? Without states there is either no traffic or something really wrong.. I would would do a clean install to be honest.
-
Is traffic flowing through the firewall?
No, it work only the services, are directly connected on the WAN interface, such as squid, ipsec, ovpn etc…
Without states there is either no traffic or something really wrong..
Yes i know :D
I would would do a clean install to be honest.
Thats the Problem
It is a new clean install. I have reinstalled the latest version of pfSense (2.1.5 live-install x64), once on an APU and once on an NF9D-2550 board… both the same result.
As soon as I set on manual NAT and make a restart, NAT doesn't work anymore.I have now the v2.1.4 installed on my APU, and there it works with manual NAT. I don't know why ?!
-
well seems your doing the nats wrong.. lets see these nats your doing.
so it works if you have auto nats out of the box on a clean install?
-
If I do a clean install, Auto NAT works.
Because, when I switch from Auto-NAT to manual NAT and let the auto settings, add a manual rule and make a restart, has NAT stopped working.2.1.4 everything runs without any problems, but under 2.1.5 with the same mappings, NAT stops (after reboot)
By the way, i have an Alix with 2.1.5 nano-bsd image, there manual NAT runs without problems :o
Here a screenshot of a mapping without Multiwan.
-
So its working with the auto, even switched to manual.. But when "add a manual rule and make a restart, has NAT stopped working."
So what are you adding - clearly this is what is breaking it.
-
To me this outbound NAT looks strange. I don't see how it could work well. I'd expect everything to exit over wan_kdg with these setting.
-
???
Guys, i have only to add one rule, the system itself has created all other rules ?!
What should be wrong?
-
Why do you have same source network on 2 different interfaces? 172.20/16 And then your openvpn network overlaps with that?
-
The Ovpn interface (HideMyAss) can be seen as a WAN interface and the LAN Device going depending on the Firewall Rule either over WAN_KDG or Hidemyass
-
johnpoz - Thats my question. Its possible my understanding of outbound NAT is broken.
But to me it seems this set of rules wont work well. -
johnpoz - Thats my question. Its possible my understanding of outbound NAT is broken.
But to me it seems this set of rules wont work well.They will not work.
You have 2 rules passing traffic on both WAN_KDG and HYDEMYASS from 172.20.0.0/16 and having the default gateway. The first condition matching the rule will be processed, it means that the one on HYDEMYASS will never be processed.
If my understanding of Outbound NAT is correct.
-
It is. First come, first served.
-
unless you use a firewall rule ….. ;)
-
Yes - You can do it with a firewall rule. Those are also first come first served.
I wouldn't try doing it in two places though. Pick one.
