Help using NAT to simulate external networks
-
Hello!
I'm creating a small penetration testing training environment and using pfSense as the main firewall. I'm simulating different networks using various reserved IP spaces. Each range is specified as an interface and are local LANs within pfSense. Here's a simplified example of the IP spaces being used:
Users: 10.10.10.0/24
Internet: 172.16.0.0/24
Corporate Network: 192.168.10.0/24I'm trying to simulate a real-world network where a corporation has one public IP on the "Internet", and all outbound traffic from the corporate network would maintain that IP address. I've tried following various guides, creating NAT rules, virtual IPs, or using firewall rules to specify a different gateway, and nothing seems to work. Traffic from the corporate network to another "Internet" site or user is showing their 192.168.10.xx address rather than their "Internet" gateway address.
Any suggestions on how to configure this?
Thanks in advance!
-
Those networks if on "lan" interfaces of pfsense would not nat between themselves unless you set it to do that..
Not sure what you mean by showing their internet gateway address - it would never show that.. It would show their public IP, not their gateway.. So normally you would have something like this
internet – ISP (1.2.3.1) ---- (1.2.3.14) pfsense (192.168.1.1) -- local network (192.168.1.100) PC
To pfsense the public IP 1.2.3.1 is its "gateway"
To the PC pfsense 192.168.1.1 is its gatewaySo if PC talks to something on the internet - say www.google.com, google would see the traffic pfsense wan IP 1.2.3.14 not a "gateway" address.
If your trying to nat between lan side networks on pfsense your going to have to manually set that up. Pfsense is not going to nat its internal networks to each other.
Please draw out how you have this configured. Do you have it something like this??
-
When I wanted to do that sort of testing, I just used a cheap NAT router. It provided DHCP to the firewall and I could connect the computer used for testing to one of the other LAN ports. Worked well.
-
Those networks if on "lan" interfaces of pfsense would not nat between themselves unless you set it to do that..
Correct - this is what I'm looking for help doing.
Your network diagram is correct. I'd like the corporate network, 192.168.10.0/24, to have a public IP on the "Internet" range, say 172.16.0.55. Any traffic leaving the corporate network and accessing another "Internet" IP would show 172.16.0.55 in server logs instead of it's 192.168.10.0/24 address.
-
Not sure why you would want to do that to be honest - not getting what that buys you at all.. But sure go to outbound nats and change to hybrid or manual mode and create the nats you want.
To be honest I think I have gone over this sort of thing before when user needed to source nat from their openvpn connection, etc.
I am on the road for work, and be much easier to put together pictures and how to do it between my multiple segments when I get home - if you can wait til say tmrw morning when I should have some time to do this I can put an example of natting between local segments. But I still don't see the point?? What aspect of natting are you trying to simulate to the internet? To test what exactly?
