Nat Public IP range to servers
-
Hello,
I try to NAT our IP range to some servers but nothing works. Could you help me please ?
pFsense was restored to defaults factory settings before the tests.
Version 2.3.2-RELEASEMy WAN Configuration
My LAN (Plugged on OPT2)
I created all virtual IPs
And NAT some of them for the tests
I wrote some rules on the Firewall but let them open while running tests
The outbound is in automatic mode and I didn't change any other settings.
Does anyone has an idea to resolve my problem ?
Any help would be greatly appreciated
-
So where you can have a problem is if your nat outbound is automatic it would be natting your return to your actual wan IP. Most devices will not like this..
Hey I talked to x.x.x.A and x.x.x.B responded - that is not right!!!
So you need to change your outbound nat to have it nat to the vip your sending to your internal box, so they use that vip when talking outbound or answering.
-
johnpoz is right.
From Firewall>NAT>Outbound, change rule to Hybrid Outbound NAT and add mappings:
For WAN interface:
Src 172.16.214.17 Dst * -> NAT Address xxx.xxx.xxx.129
Src 172.16.214.17 Dst * -> NAT Address xxx.xxx.xxx.129
…Like this, exact reverse src and dst of 1:1 NAT rule.
-
1:1 NAT works both ways. Outbound NAT is automatic there.
Manual outbound NAT is necessary if you want egress connections to be on the same VIP as a port forward address.
-
Many thanks for you replies, i will try this tomorrow and reply after :)
-
1:1 NAT works both ways. Outbound NAT is automatic there.
Manual outbound NAT is necessary if you want egress connections to be on the same VIP as a port forward address.
Derelict I'm confused, please help to de-confuse me.
Shortly I am going to be doing the same thing, multiple WAN IP's, one of which I will use purely for my mail server.
So I do a 1:1 NAT from a given VIP, but I do not follow your comment as you say 1:1 NAT works both ways but outbound connections need a manual outbound NAT, which is it and why?
-
If you have a port forward to an inside host that forwards VIP:port to inside_address:port you need manual outbound NAT mapping traffic sourced from inside_address to that same VIP if you want outbound connections to egress on the same VIP.
If you 1:1 NAT for VIP:inside_address this is automatic.
-
Got you. So if you do 1:1 then you do not need outbound NAT mapping. Consider me un-confused.
Next question. Currently I have a rule for specific ports, 443, 993 etc that get set by the NAT rule, the destination is a my mail server LAN address. How do I implement a rule to do the same thing when using 1:1 NAT?
I also have rules that only allow my smtp port to be accessed by certain addresses, I use a cloud spam filter service, I will be changing the address that service delivers to one of my VIPs, Currently the destination is set to 'This Firewall', does that remain the same or do I change it to the VIP address?
-
I think i answered my own question, i can't do 1:1 if i want to map specific ports, so i'll need to use an outbound nat.
Edit: Yes I can, I just create a WAN rule for the WAN address to allow those ports through , just use specfic WAN addresses rather than ANY for my inbound SMTP.
-
Yes. with a 1:1 you just pass the ports you want to the inside address using WAN rules.
If you did want to translate a port, say, you had a 1:1 NAT for wan_address:inside_address and you wanted wan_address:8080 to be forwarded to inside_address:80, you could still do a port forward. Port forwards take precedence over 1:1 NAT so it will be honored. The firewall rule in that case would need to pass destination inside_address:80.
