• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

NAT/Portforward VIPs block

Scheduled Pinned Locked Moved NAT
22 Posts 4 Posters 2.0k Views 4 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D Offline
    dasm0kinone
    last edited by Dec 24, 2018, 3:06 PM

    Steve,

    Im still having an issue with the rules. Could you help/explain to me how to set up source/destination for the rules for this? I'm kind of struggling with it. Thank you.

    1 Reply Last reply Reply Quote 0
    • S Online
      stephenw10 Netgate Administrator
      last edited by Dec 24, 2018, 7:04 PM

      To just allow traffic out from clients on the VLAN6 subnet you just need a single rule on the VLAN6 interface.

      Action: Pass
      Interface: VLAN6
      Protocol: any
      Source: VLAN6net
      Destination: any

      That will allow clients to reach any other IP.

      Steve

      1 Reply Last reply Reply Quote 0
      • D Offline
        dasm0kinone
        last edited by Dec 26, 2018, 3:35 PM

        Would I have to do any rules on the LAN since its a VLAN using the LAN interface? Still getting a NO_TRAFFIC:SINGLE on the VLAN6.

        Current LAN rules allow all. But not sure I have to be more specific for that VLAN so I'm using it for a direct connection.

        1 Reply Last reply Reply Quote 0
        • J Offline
          johnpoz LAYER 8 Global Moderator
          last edited by Dec 26, 2018, 3:39 PM

          If you created a vlan, the rules on the parent interface - ie lan say has ZERO to do with traffic on vlan

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 25.07 | Lab VMs 2.8, 25.07

          1 Reply Last reply Reply Quote 0
          • D Offline
            dasm0kinone
            last edited by Dec 26, 2018, 3:46 PM

            Is there a dump file I can do that you could look at to see if I'm overlooking something?

            1 Reply Last reply Reply Quote 0
            • J Offline
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz Dec 26, 2018, 3:59 PM Dec 26, 2018, 3:50 PM

              you can sniff sure, just use tcpdump.. if you use -e with tcpdump you can see the vlan tags..

              If if the rule on the parent physical interface had anything to do with the traffic on the vlan - then vlans would be completely USELESS nonsense since you wouldn't actually be isolating the traffic. Might as well just run multiple layer 3 on the same layer 2 in such scenario..

              You can also sniff using the diag / packet capture web gui.. But doesn't allow you to see the vlan tags because you can not call out -e

              Where exactly are you seeing
              "NO_TRAFFIC:SINGLE on the VLAN6."

              What state exactly... That info doesn't mean much without more context.

              What exactly is not working? What do you have configured on your switch to allow for the vlan6 you setup, guessing you used vlan ID 6 when you setup that vlan in pfsense? So you have trunk connected to your physical interface on pfsense frm your switch, and then port where you laptop connected via untagged access port in vlan 6, etc.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 25.07 | Lab VMs 2.8, 25.07

              1 Reply Last reply Reply Quote 0
              • S Online
                stephenw10 Netgate Administrator
                last edited by Dec 26, 2018, 4:04 PM

                Have you actually created a VLAN6 interface in Interfaces > Assignments > VLANs?

                Steve

                1 Reply Last reply Reply Quote 0
                • D Offline
                  dasm0kinone
                  last edited by Dec 26, 2018, 4:10 PM

                  When I look at the "States Detail" under rules for VLAN its stating NO_TRAFFIC:SINGLE" Im unable to get online.
                  I have a trunk port setup on my switch and my other VLANs are working properly but using a local subnet. I do have Port 6 tagged for VLAN 6.

                  I disabled all the NAT for VLAN 6 and keep the rest all the same.

                  Steve: Yes I have VLAN 6 created and I have the public IP block assigned to that interface.

                  What specific rules I would have to create on the WAN?

                  1 Reply Last reply Reply Quote 0
                  • S Online
                    stephenw10 Netgate Administrator
                    last edited by Dec 26, 2018, 4:39 PM

                    You shouldn't need any rules on WAN to allow traffic out from the VLAN6 subnet.

                    Try to ping out from Diag > Ping choosing the VLAN6 interface as the source address.

                    It sounds like maybe your ISP is not actually routing that subnet to your WAN IP.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      dasm0kinone
                      last edited by Dec 26, 2018, 4:49 PM

                      I cant ping from that interface. this is what the ISP sent to me

                      set routing-options static route 65.15X.XXX.X44/29 next-hop 67.1XX.XXX.198

                      set routing-options static route 63.23X.XXX.X76/28 next-hop 67.1XX.XXX.198

                      So I used the /29 for the WAN and the /28 for VLAN6

                      1 Reply Last reply Reply Quote 0
                      • J Offline
                        johnpoz LAYER 8 Global Moderator
                        last edited by Dec 26, 2018, 5:19 PM

                        So they directly attached it to you... Not routed it..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07 | Lab VMs 2.8, 25.07

                        1 Reply Last reply Reply Quote 0
                        • D Offline
                          dasm0kinone
                          last edited by Dec 26, 2018, 5:32 PM

                          Ok knowing that now. How would I go about configuring the IPs then?

                          1 Reply Last reply Reply Quote 0
                          • J Offline
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz Dec 26, 2018, 5:33 PM Dec 26, 2018, 5:32 PM

                            Get them to actually route it to you... Or you would have to use vips and port forwarding.

                            They are also having you set gateways outside the IP block... Not very good idea to be honest as well.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 25.07 | Lab VMs 2.8, 25.07

                            D 1 Reply Last reply Dec 26, 2018, 7:13 PM Reply Quote 0
                            • D Offline
                              dasm0kinone
                              last edited by Dec 26, 2018, 6:16 PM

                              If i were to use VIP and port forwards would I have to port forward any devices they use on the network or can you they do that through there firewall? Also with the portforward what IP would be used for the gateway?

                              1 Reply Last reply Reply Quote 0
                              • D Offline
                                dasm0kinone @johnpoz
                                last edited by Dec 26, 2018, 7:13 PM

                                @johnpoz
                                Could I just assign another nic interface for that second IP block? then Have the VLAN go to that?

                                1 Reply Last reply Reply Quote 0
                                • D Offline
                                  Derelict LAYER 8 Netgate
                                  last edited by Dec 26, 2018, 7:37 PM

                                  No. The ISP should route 63.23X.XXX.X76/28 to an address in 65.15X.XXX.X44/29. They should provision your service properly.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • D Offline
                                    dasm0kinone
                                    last edited by Dec 26, 2018, 9:27 PM

                                    Thank you all for your help. I got the ISP to route the IPs and it worked how you all explained it.

                                    1 Reply Last reply Reply Quote 1
                                    • S Online
                                      stephenw10 Netgate Administrator
                                      last edited by Dec 26, 2018, 10:18 PM

                                      Nice. 😀

                                      1 Reply Last reply Reply Quote 0
                                      22 out of 22
                                      • First post
                                        22/22
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                        This community forum collects and processes your personal information.
                                        consent.not_received