Basic out-going NAT isn't working
-
Firewall is routing the packets like it's a router. Capturing the packets on the WAN interface shows that the source IP remains unchanged (private IP).
I've triple checked that setting on Setup>>Firewall/NAT>>Disable all packet filtering isn't on.
Outbound NAT rules are set to automatic, but even configuring it to Manually and adding a default rule doesn't do anything.I haven't seen anything useful in the system logs.
A "pfctl -s state" command returns an empty table.
I upgraded it from 2.1.4 to 2.1.5 thinking maybe something behind the scenes was causing problems but whatever is going on must be in the configuration file as the issue persists.
How does pfSense determine which interfaces require natting? Does it have something to do with an interface having a default gateway?
Any other things I can check for via the console?
I heard that pfblocker can cause problems. I did have it installed but removed it to rule it out.
Besides rebuilding the firewall I'm out of ideas.
Help me Obi Wan Kenobi, you're my only hope!
-
:D
Have you defined a gateeway in routing menu?
-
The WAN interface is configured as DHCP. The gateway is automatically and assigned due to that. looking at the route table the default gateway seems just fine.
-
And you have set DNS in DNS settings for FW ?
-
hmm, I want to say yes, but I also know that they weren't ideal. Let me have a look at that.
Edit: The "Allow DNS server list to be overridden by DHCP/PPP on WAN" is checked and the DNS servers are listed correctly on the dashboard.
-
So lets see this sniff where your saying IP is not being changed. Change back to auto on your outbound nat.
what does your state table look like - your not seeing a state that has been natted?
-
Same Problem here with v. 2.1.5 :/
As soon as I make any change under 2.1.5 on the outbound NAT, NAT doesn't work anymore.
A return to automatic also does not work anymore
I have downgraded to 2.1.4 and it works again.
I have already opened a thread due to the problem in the German section. (sry for duple Post)
-
So as I asked the OP, lets see your state stable showing these unchanged IPs and lets see your nat table. There rarely is a reason to use manual if you ask me. What did you think you required manual natting outbound for?
-
I use manual NAT for Multi-WAN and a OVPN Interface.
-
So ok, lets see these states where your not changing the outbound IP and your outbound nat rules.. Without some info to work from, its just PEBKAC sorry ;)
"NAT doesn't work anymore."
Do you take your car to the mech and just say it doesn't work anymore ;) Do you go to the doc and when he asks whats wrong - "I'm Sick"
-
Sorry for the poor information. My english is cruel.
It is very complicated for me to detail to write in english.
It is easier for me if you tell me by what and how I look and I'll tell you what comes out, ok ?
One in advance … the command "pfctl -s state" brings an empty result, the firewall-log is empty
-
so this is empty?
[2.1.5-RELEASE][root@pfsense.local.lan]/root(3): pfctl -s state
vmx3f0 ipv6 24.13.xx.xx -> 184.105.253.14 MULTIPLE:MULTIPLE
vmx3f0 ipv6-icmp ff02::1[192] <- fe80::201:5cff:fe66:4046 NO_TRAFFIC:NO_TRAFFIC
gif0 ipv6-icmp 2001:470:xxx:9c4::2[51329] -> 2001:470:xxx:9c4::1 NO_TRAFFIC:NO_TRAFFIC
vmx3f2 tcp 17.110.224.14:443 <- 192.168.2.230:56975 ESTABLISHED:ESTABLISHED
vmx3f0 tcp 192.168.2.230:56975 -> 24.13.xx.xx:1609 -> 17.110.224.14:443 ESTABLISHED:ESTABLISHED
vmx3f0 ipv6-icmp ff02::1 <- fe80::201:5cff:fe66:4046 NO_TRAFFIC:NO_TRAFFIC
vmx3f1 tcp 70.37.56.25:443 <- 192.168.1.100:26456 ESTABLISHED:ESTABLISHED
<snipped rest="" of="" output="">Then you got NOTHING going through your pfsense if you have no STATES!! Did you turn off nat and firewalling and just using it as a router?</snipped> -
what can I say … :-\
/root(5): pfctl -s state
/root(6):
-
Is traffic flowing through the firewall? Without states there is either no traffic or something really wrong.. I would would do a clean install to be honest.
-
Is traffic flowing through the firewall?
No, it work only the services, are directly connected on the WAN interface, such as squid, ipsec, ovpn etc…
Without states there is either no traffic or something really wrong..
Yes i know :D
I would would do a clean install to be honest.
Thats the Problem
It is a new clean install. I have reinstalled the latest version of pfSense (2.1.5 live-install x64), once on an APU and once on an NF9D-2550 board… both the same result.
As soon as I set on manual NAT and make a restart, NAT doesn't work anymore.I have now the v2.1.4 installed on my APU, and there it works with manual NAT. I don't know why ?!
-
well seems your doing the nats wrong.. lets see these nats your doing.
so it works if you have auto nats out of the box on a clean install?
-
If I do a clean install, Auto NAT works.
Because, when I switch from Auto-NAT to manual NAT and let the auto settings, add a manual rule and make a restart, has NAT stopped working.2.1.4 everything runs without any problems, but under 2.1.5 with the same mappings, NAT stops (after reboot)
By the way, i have an Alix with 2.1.5 nano-bsd image, there manual NAT runs without problems :o
Here a screenshot of a mapping without Multiwan.
-
So its working with the auto, even switched to manual.. But when "add a manual rule and make a restart, has NAT stopped working."
So what are you adding - clearly this is what is breaking it.
-
To me this outbound NAT looks strange. I don't see how it could work well. I'd expect everything to exit over wan_kdg with these setting.
-
???
Guys, i have only to add one rule, the system itself has created all other rules ?!
What should be wrong?
