• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

NAT all traffic from alias except a single port/IP

Scheduled Pinned Locked Moved NAT
23 Posts 4 Posters 3.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • K Online
    KOM
    last edited by Oct 14, 2015, 8:55 PM

    Don't describe what you think you have done.  Post screens of your firewall & NAT rules.

    1 Reply Last reply Reply Quote 0
    • L Offline
      lastb0isct
      last edited by Oct 14, 2015, 8:58 PM

      Added Screenshots…sorry about that.

      NAT_RULE.PNG
      NAT_RULE.PNG_thumb
      Firewall_Rules.PNG
      Firewall_Rules.PNG_thumb

      1 Reply Last reply Reply Quote 0
      • D Offline
        Derelict LAYER 8 Netgate
        last edited by Oct 14, 2015, 9:07 PM

        You probably don't want to set a source port to match on.  Source ports are almost always random.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • V Offline
          viragomann
          last edited by Oct 14, 2015, 9:33 PM Oct 14, 2015, 9:21 PM

          If you want the source port to keep the same after NAT check "static port" in translation section.

          1 Reply Last reply Reply Quote 0
          • L Offline
            lastb0isct
            last edited by Oct 14, 2015, 10:16 PM

            Thank you for the tips.  I have done these but haven't had time to reboot my systems or test anymore.

            I will take a look later.

            1 Reply Last reply Reply Quote 0
            • D Offline
              Derelict LAYER 8 Netgate
              last edited by Oct 15, 2015, 12:58 AM

              Reboot? No reboot necessary to change rules.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • L Offline
                lastb0isct
                last edited by Oct 15, 2015, 1:06 AM

                Should be seeing it immediately after applying?  I'll have to take a look at the logs then.

                1 Reply Last reply Reply Quote 0
                • D Offline
                  Derelict LAYER 8 Netgate
                  last edited by Oct 15, 2015, 6:01 AM

                  I never reboot pfSenses except when I update them.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • L Offline
                    lastb0isct
                    last edited by Oct 15, 2015, 5:10 PM

                    I just tested updating this rule on the fly.  I've updated the 2nd rule several times with no different results to get a specific port through.  The port always stays going through the OpenVPN interface.

                    I have added a rule to the firewall rules and messed around with the port that the rule uses, but have had no luck.

                    Any other insight into how to get this working properly?

                    Firewall_Rules_new.PNG
                    Firewall_Rules_new.PNG_thumb
                    NAT_RULE_new.PNG
                    NAT_RULE_new.PNG_thumb

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      Derelict LAYER 8 Netgate
                      last edited by Oct 15, 2015, 7:15 PM

                      Just so it's clear, outbound NAT rules do absolutely nothing to forward traffic.  The simply tell the router how to NAT any traffic outbound on the subject interface. The traffic has to be routed out the interface by other means first.

                      That said, you don't need the specific NAT rule.  The auto-generated rules will NAT the traffic just fine.

                      It looks like you are trying to policy route https connections from 192.168.1.62 out WAN_DHCP instead of OPT1TOPIA_VPN4.

                      Is 192.168.1.62 in alias OVPN_hosts?

                      I just tested updating this rule on the fly.  I've updated the 2nd rule several times with no different results to get a specific port through.  The port always stays going through the OpenVPN interface.

                      I have added a rule to the firewall rules and messed around with the port that the rule uses, but have had no luck.

                      Highlighted are places you should be more specific.  IP addresses, interface names, port protocols and numbers.

                      What, specifically, are you trying to do?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • L Offline
                        lastb0isct
                        last edited by Oct 15, 2015, 7:24 PM

                        Yes, you're correct in that 192.168.1.62 is in OVPN_hosts.

                        I just tested updating NAT Outbound rules on the fly.  I've updated the 192.168.1.62 rule several times with no different results to get port 443 through.  443 always stays going through OPT1TOPIA interface.

                        I have added the 443 firewall rule and messed around with the port range in that rule, but have had no luck.

                        Hope that gives you more of an idea of what i've done.  The screenshots really show all the changes i've done, but they haven't done anything.

                        1 Reply Last reply Reply Quote 0
                        • D Offline
                          Derelict LAYER 8 Netgate
                          last edited by Oct 15, 2015, 7:45 PM

                          How are you testing?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • L Offline
                            lastb0isct
                            last edited by Oct 15, 2015, 7:50 PM

                            Checking traffic graphs,  interface stats and the speeds are not what they should be.  Speeds should be flying when not on the VPN, but i'm seeing quite slow speeds.

                            1 Reply Last reply Reply Quote 0
                            • D Offline
                              Derelict LAYER 8 Netgate
                              last edited by Oct 15, 2015, 7:57 PM

                              That's no way to test routing.  All you should be caring about it what interface your traffic is going out on.  Performance is another issue.

                              Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • L Offline
                                lastb0isct
                                last edited by Oct 16, 2015, 12:01 AM

                                @Derelict:

                                That's no way to test routing.  All you should be caring about it what interface your traffic is going out on.  Performance is another issue.

                                Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?

                                I specified that i am looking at my traffic graphs/interface stats which show the traffic that is going in/out on my 192.168.1.62 machine is being routed through the OPT1TOPIA interface.  The OPT1TOPIA interface is nearly the same as the LAN/WAN interface when testing.  The 192.168.1.62 machine is a linux box and testing it via cmd line to ipchicken shows that it is using the OPT1TOPIA IP address, though i'm not sure how to test a specific port.  Not sure if you'd be able to verify that only port 443 is going through a different IP address via ipchicken or wimi.

                                All of the traffic going to 192.168.1.62 is going through the OPT1TOPIA interface in my graphs and logs.  Performance is directly related to VPN connectivity since PIA doesn't have the bandwidth to support my full 300mbps download bandwidth.

                                1 Reply Last reply Reply Quote 0
                                • D Offline
                                  Derelict LAYER 8 Netgate
                                  last edited by Oct 16, 2015, 12:22 AM

                                  Well, what you have posted looks right so you must have something someplace else.  Did you mess around in floating rules?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • L Offline
                                    lastb0isct
                                    last edited by Oct 16, 2015, 12:30 AM

                                    I haven't touched much other than that what you're seeing.  These were the instructions i followed to get PIA OpenVPN setup to only that alias:

                                    https://forum.pfsense.org/index.php?topic=72902.msg397636#msg397636

                                    1 Reply Last reply Reply Quote 0
                                    • D Offline
                                      Derelict LAYER 8 Netgate
                                      last edited by Oct 16, 2015, 12:34 AM

                                      Doesn't matter what a walkthrough says.  What matters is what your config is.

                                      There must be something somewhere else or it would be working.

                                      If you disable the VPN is 192.168.1.62 happy routing out the WAN_DHCP interface?

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • L Offline
                                        lastb0isct
                                        last edited by Oct 16, 2015, 1:26 AM

                                        I was just giving a reference to what I did.

                                        I will test that in a bit as i'm not home.

                                        1 Reply Last reply Reply Quote 0
                                        • L Offline
                                          lastb0isct
                                          last edited by Oct 16, 2015, 5:42 PM Oct 16, 2015, 5:37 PM

                                          Yes, the 192.168.1.62 machine is fine with routing directly through the WAN interface.  Have to clear states to get it to behave that way though since it holds on to the OPT1TOPIA interface until states have been refreshed.

                                          EDIT: I do also notice that it helps restarting the 192.168.1.62 machine when making those changes or else it stays in a funky state.  Upon rebooting it behaves at it should through the WAN_DHCP interface.

                                          1 Reply Last reply Reply Quote 0
                                          21 out of 23
                                          • First post
                                            21/23
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received