Basic out-going NAT isn't working
-
Is traffic flowing through the firewall?
No, it work only the services, are directly connected on the WAN interface, such as squid, ipsec, ovpn etc…
Without states there is either no traffic or something really wrong..
Yes i know :D
I would would do a clean install to be honest.
Thats the Problem
It is a new clean install. I have reinstalled the latest version of pfSense (2.1.5 live-install x64), once on an APU and once on an NF9D-2550 board… both the same result.
As soon as I set on manual NAT and make a restart, NAT doesn't work anymore.I have now the v2.1.4 installed on my APU, and there it works with manual NAT. I don't know why ?!
-
well seems your doing the nats wrong.. lets see these nats your doing.
so it works if you have auto nats out of the box on a clean install?
-
If I do a clean install, Auto NAT works.
Because, when I switch from Auto-NAT to manual NAT and let the auto settings, add a manual rule and make a restart, has NAT stopped working.2.1.4 everything runs without any problems, but under 2.1.5 with the same mappings, NAT stops (after reboot)
By the way, i have an Alix with 2.1.5 nano-bsd image, there manual NAT runs without problems :o
Here a screenshot of a mapping without Multiwan.
-
So its working with the auto, even switched to manual.. But when "add a manual rule and make a restart, has NAT stopped working."
So what are you adding - clearly this is what is breaking it.
-
To me this outbound NAT looks strange. I don't see how it could work well. I'd expect everything to exit over wan_kdg with these setting.
-
???
Guys, i have only to add one rule, the system itself has created all other rules ?!
What should be wrong?
-
Why do you have same source network on 2 different interfaces? 172.20/16 And then your openvpn network overlaps with that?
-
The Ovpn interface (HideMyAss) can be seen as a WAN interface and the LAN Device going depending on the Firewall Rule either over WAN_KDG or Hidemyass
-
johnpoz - Thats my question. Its possible my understanding of outbound NAT is broken.
But to me it seems this set of rules wont work well. -
johnpoz - Thats my question. Its possible my understanding of outbound NAT is broken.
But to me it seems this set of rules wont work well.They will not work.
You have 2 rules passing traffic on both WAN_KDG and HYDEMYASS from 172.20.0.0/16 and having the default gateway. The first condition matching the rule will be processed, it means that the one on HYDEMYASS will never be processed.
If my understanding of Outbound NAT is correct.
-
It is. First come, first served.
-
unless you use a firewall rule ….. ;)
-
Yes - You can do it with a firewall rule. Those are also first come first served.
I wouldn't try doing it in two places though. Pick one.
-
So I do not know what you want.
"DUAL" NAT works at the same time. Tested in 2.1.4
psctl -s state | grep 172.20.111.13
ovpnc5 icmp 172.20.111.13:1 -> 10.200.1.4:43502 -> 8.8.4.4 0:0
re1 icmp 172.20.111.13:1 -> 92.99.22.149:61907 -> 8.8.8.8 0:0 -
I have all my NAT here at home set up the same way. Using a failover gateway group of WAN (cable) and DSL. Works perfectly (2.1.5). OP should be able to send outbound traffic to either gateway using policy routing and it should catch the correct NAT rule.
rubinho what are the firewall rules and gateways / gateway groups set up like?
-
At the moment i have no failover WAN , only one gateway rule for a separate proxy that goes over VPN (HideMyAss).
I must first take my Voipserver running before I plug in my second WAN into pfsense
