Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT all traffic from alias except a single port/IP

    Scheduled Pinned Locked Moved NAT
    23 Posts 4 Posters 3.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      lastb0isct
      last edited by

      Added Screenshots…sorry about that.

      NAT_RULE.PNG
      NAT_RULE.PNG_thumb
      Firewall_Rules.PNG
      Firewall_Rules.PNG_thumb

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        You probably don't want to set a source port to match on.  Source ports are almost always random.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • V
          viragomann
          last edited by

          If you want the source port to keep the same after NAT check "static port" in translation section.

          1 Reply Last reply Reply Quote 0
          • L
            lastb0isct
            last edited by

            Thank you for the tips.  I have done these but haven't had time to reboot my systems or test anymore.

            I will take a look later.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Reboot? No reboot necessary to change rules.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • L
                lastb0isct
                last edited by

                Should be seeing it immediately after applying?  I'll have to take a look at the logs then.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  I never reboot pfSenses except when I update them.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • L
                    lastb0isct
                    last edited by

                    I just tested updating this rule on the fly.  I've updated the 2nd rule several times with no different results to get a specific port through.  The port always stays going through the OpenVPN interface.

                    I have added a rule to the firewall rules and messed around with the port that the rule uses, but have had no luck.

                    Any other insight into how to get this working properly?

                    Firewall_Rules_new.PNG
                    Firewall_Rules_new.PNG_thumb
                    NAT_RULE_new.PNG
                    NAT_RULE_new.PNG_thumb

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Just so it's clear, outbound NAT rules do absolutely nothing to forward traffic.  The simply tell the router how to NAT any traffic outbound on the subject interface. The traffic has to be routed out the interface by other means first.

                      That said, you don't need the specific NAT rule.  The auto-generated rules will NAT the traffic just fine.

                      It looks like you are trying to policy route https connections from 192.168.1.62 out WAN_DHCP instead of OPT1TOPIA_VPN4.

                      Is 192.168.1.62 in alias OVPN_hosts?

                      I just tested updating this rule on the fly.  I've updated the 2nd rule several times with no different results to get a specific port through.  The port always stays going through the OpenVPN interface.

                      I have added a rule to the firewall rules and messed around with the port that the rule uses, but have had no luck.

                      Highlighted are places you should be more specific.  IP addresses, interface names, port protocols and numbers.

                      What, specifically, are you trying to do?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • L
                        lastb0isct
                        last edited by

                        Yes, you're correct in that 192.168.1.62 is in OVPN_hosts.

                        I just tested updating NAT Outbound rules on the fly.  I've updated the 192.168.1.62 rule several times with no different results to get port 443 through.  443 always stays going through OPT1TOPIA interface.

                        I have added the 443 firewall rule and messed around with the port range in that rule, but have had no luck.

                        Hope that gives you more of an idea of what i've done.  The screenshots really show all the changes i've done, but they haven't done anything.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          How are you testing?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • L
                            lastb0isct
                            last edited by

                            Checking traffic graphs,  interface stats and the speeds are not what they should be.  Speeds should be flying when not on the VPN, but i'm seeing quite slow speeds.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              That's no way to test routing.  All you should be caring about it what interface your traffic is going out on.  Performance is another issue.

                              Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • L
                                lastb0isct
                                last edited by

                                @Derelict:

                                That's no way to test routing.  All you should be caring about it what interface your traffic is going out on.  Performance is another issue.

                                Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?

                                I specified that i am looking at my traffic graphs/interface stats which show the traffic that is going in/out on my 192.168.1.62 machine is being routed through the OPT1TOPIA interface.  The OPT1TOPIA interface is nearly the same as the LAN/WAN interface when testing.  The 192.168.1.62 machine is a linux box and testing it via cmd line to ipchicken shows that it is using the OPT1TOPIA IP address, though i'm not sure how to test a specific port.  Not sure if you'd be able to verify that only port 443 is going through a different IP address via ipchicken or wimi.

                                All of the traffic going to 192.168.1.62 is going through the OPT1TOPIA interface in my graphs and logs.  Performance is directly related to VPN connectivity since PIA doesn't have the bandwidth to support my full 300mbps download bandwidth.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Well, what you have posted looks right so you must have something someplace else.  Did you mess around in floating rules?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    lastb0isct
                                    last edited by

                                    I haven't touched much other than that what you're seeing.  These were the instructions i followed to get PIA OpenVPN setup to only that alias:

                                    https://forum.pfsense.org/index.php?topic=72902.msg397636#msg397636

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Doesn't matter what a walkthrough says.  What matters is what your config is.

                                      There must be something somewhere else or it would be working.

                                      If you disable the VPN is 192.168.1.62 happy routing out the WAN_DHCP interface?

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • L
                                        lastb0isct
                                        last edited by

                                        I was just giving a reference to what I did.

                                        I will test that in a bit as i'm not home.

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          lastb0isct
                                          last edited by

                                          Yes, the 192.168.1.62 machine is fine with routing directly through the WAN interface.  Have to clear states to get it to behave that way though since it holds on to the OPT1TOPIA interface until states have been refreshed.

                                          EDIT: I do also notice that it helps restarting the 192.168.1.62 machine when making those changes or else it stays in a funky state.  Upon rebooting it behaves at it should through the WAN_DHCP interface.

                                          1 Reply Last reply Reply Quote 0
                                          • L
                                            lastb0isct
                                            last edited by

                                            I was able to figure this out!  Attached are the rules. I figured out that it was traffic on port 563 that was needed and did a bi-directional rule.

                                            Is there any easier way to do bi-directional rules than how i did it here?

                                            ![Usenet success.PNG](/public/imported_attachments/1/Usenet success.PNG)
                                            ![Usenet success.PNG_thumb](/public/imported_attachments/1/Usenet success.PNG_thumb)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.