Reduce Outgoing NAT rules
-
so a spammer? ;)
So these 2000 IPs are on a netblock not actually routed to you? If the segment(s) were routed to you - you would put them directly behind pfsense and not have to create VIPs and nats at all.
-
This is similar but I am unsure of my etiquette. Please forgive me if I am posting incorrectly. I really have tried to search for the solution. I have used pfsense for several years and love it, haven't needed to ask help. I also would like to streamline port rules. I went to aliases to make a bundle of the ports I need for a mail server, then I just applied the bundle to each server with an outside virtual ip to separate the traffic. Because this does not work, I guess the ports have to be in succession or it does not work. Is this correct?
-
After looking at this post you did, I deleted the destination ports in my rules and put any in there. Now all traffic is sent there. Is this a bad rule?
https://forum.pfsense.org/index.php?topic=112710.msg627209#msg627209 -
Not sure how creating a alias is sim to the OP question..
If you have a question about how to do a alias, start your own thread would of been proper. No your port in your aliases do not have to be sequential
So your asking if you can do a port forward rule with multiple ports in via an alias? Like forward 80,443 to the same box in one rule via an alias?
"I deleted the destination ports in my rules and put any in there."
So you have a port forward rule with ANY as the destination? Yeah that would normally be BAD!!
-
These IPs are routed to me but the issue is I have multiple servers that need to use the same external IP address.
-
"These IPs are routed to me but the issue is I have multiple servers that need to use the same external IP address."
Sounds like you have a mess - why would your servers that have a public IP need to use the same one?
-
If you have multiple LAN addresses that need to use the same public IP you should group your LAN servers to contiguous groups of addresses that all share the same public IP within a single group. Then you can reduce the individual outbound NAT rules to fewer rules that each match a wider network (the source network setting) than just a single address.
For example if you have managed to get a group of servers that all use the same public IP (let's say 4 of them) into addresses 192.168.1.128 - 192.168.1.131 that can be matched in a single outbound NAT rule with a source network specification 192.168.1.128/30.
-
if his public IPs are routed to him, why would he be doing nat in the first place??
Confused to this setup.. So you have 2000 public IPs but more than that in servers? So you need to have lets say these 4000 servers share these 2000 public IPs?
-
Well yes if the IP block is routed then I don't see the point of doing any NAT, he is either not aware that a routed subnet can be used directly on LAN or DMZ hosts or he has omitted some important details of the setup.
-
The way it is currently setup is that we have 4 servers that all have 2000 private IPs added to them. Then their are Outbound NAT rules to map the private to the public IP. So with 4 servers we would have 4 private IPs mapped to each public IP.
-
Group like servers within subnet boundaries so you can include multiple servers with one subnet entry.
Define and use aliases for the source addresses.
