Simple address forwarding
-
I'm a new user trying to do the simplest thing imaginable or so I thought. I'm testing some hardware that will end up in a NAT-ed environment so I'm trying to simulate the NAT behavior with pfsense running in an Oracle VM Virtualbox. There are no security concerns in this environment, and I am currently not concerned with performance either.
My hardware widget has a static IP address of 192.168.0.25 and the target environment will have a subnet of 192.168.x.0/16 and it will NAT any traffic to 192.168.x.25 to 192.168.0.25. Despite the overlap in address space it seems like pfsense should not care, but so far I can't get it to forward. For development of this config I am setting x = 134 and I have been setting the subnet to /24 just in case the /16 is a problem here.
The widget has a /16 subnet so that traffic from it to 192.168.134.y will go through its ethernet interface. For the moment the role of widget is being played by another windows laptop with an ethernet interface.My Windows host has an ethernet port at 192.168.0.1 and I plug the widget into it. In virtualbox there is a bridged network adapter for this interface and its ip address assigned in pfsense is 192.168.0.200. I'm treating this as the WAN side since it's foreign to the rest of the subnet.
The virtualbox also has a "host-only" virtual adapter so that windows and any virtualbox VMs can use this like a LAN. On windows this has an address of 192.168.134.1, and in pfsense I have an interface of 192.168.134.200. From pfsense shell I can ping all the ip addresses listed so far.
The main thing was to set up an NAT 1:1 rule with
interface = LAN134
external IP = 192.168.0.25
internal IP = 192.168.134.25
destination IP = *I didn't think I needed a firewall rule since I want to pass all traffic, but when it didn't seem to work I added a rule to LAN134 to pass all protocols all ports with destination = 192.168.134.25 but that didn't help either.
I didn't have any gateways at first either, since all of my traffic is on the two subnets, but I added gateways and it did'nt help either.
The main test so far has been ping:
I can't ping 192.168.134.25 from inside the pfsense VM nor from the Windows host, they both time out.
In addition I can't ping 192.168.134.1 from the widget (that seems like it's not a pfsense issue, but any ideas they would be welcome)Any advice or diagnostic steps?
-
@wiringharness said in Simple address forwarding:
IP address of 192.168.0.25 and the target environment will have a subnet of 192.168.x.0/16
You do understand that is the same network right? 192.168.anything is part of 192.168/16
If you want those networks to be different then you need to use say /24 so now 192.168.X becomes the network.
I can tell you right now if you want any help - your going to need to put up a drawing... Trying to figure out what is what and what is where is too much work ;) Drawing makes it simple to see what your wanting to do in 2.3 seconds.
-
Thanks I am working on the drawing (for my own benefit as well). And I don't want the networks to be different, really the ONLY goal is to send traffic to 192.168.134.25 and have it show up at 192.168.0.25.
I think part of the problem is the virtualbox virtual adapter is by design internal only so the widget can't see my current .134.x subnet at all. Pings might even be getting through but there is no way for the reply to come back. Of course writing that post helped me see it.
The feedback is appreciated, I will follow up and post a drawing if I am still stick.
-
What do you mean you don't want the networks to be different?
If you have
192.168.134.100 --- 192.168.134.25 (pfsense) 192.168.0.1 --- 192.168.0.25/16
So sure .100 can send traffic to 192.168.134.25 port 80. and pfsense can port forward that 192.168.0.25, but unless you also Source Nat it 192.168.0.25/16 thinks that 192.168.134.100 is on its network.. So never sends back answer to pfsense at .1 to send on to 134.100
So 134.100 never gets anything back.
Virtual adapters works just fine - I have fired up pfsense on virtualbox many many many times.. There are natting, internal or bridging etc.. So yes you also need to understand how the networking works in virtualbox. But you also need to understand the basics of networking.
-
@johnpoz said in Simple address forwarding:
What do you mean you don't want the networks to be different?
If you have
192.168.134.100 --- 192.168.134.25 (pfsense) 192.168.0.1 --- 192.168.0.25/16
So sure .100 can send traffic to 192.168.134.25 port 80. and pfsense can port forward that 192.168.0.25, but unless you also Source Nat it 192.168.0.25/16 thinks that 192.168.134.100 is on its network.. So never sends back answer to pfsense at .1 to send on to 134.100
So 134.100 never gets anything back.
I think that is right, for now I have set the subnets to /24, and they can probably stay that way
so what I have is
192.168.134.x --- (virtualbox network) --- 192.168.134.200 (pfsense) 192.168.0.200 --- (bridged ethernet) --- 192.168.0.1 --- (cable) --- 192.168.0.25 widget
I've also attached a whiteboard photo. [upload didn't work, I'll share it shortly]so from pfsense I can ping everything, and from the widget I can ping to 192.168.134.200 now that I've set 192.168.0.200 as gateway on the widget. But I can't ping from the 192.168.134.x network to 192.168.134.25, in other words my rules don't work.
-
-
the OneDrive link crops the photo a bit, but if you click on "view original" the whole image is visible.
-
So which interface is what in pfsense... 134 is wan or lan? If the 192.168.0. 200 is normal network then pfsense has gateway on this pointing to your normal gateway which makes this pfsense WAN? And out of hte box pfsense will nat traffic from its lan to is wan.
For wan to get to lan you would have to seutp port fowards, or you would need to turn off natting and then just firewall, etc.
-
@johnpoz said in Simple address forwarding:
So which interface is what in pfsense... 134 is wan or lan? If the 192.168.0. 200 is normal network then pfsense has gateway on this pointing to your normal gateway which makes this pfsense WAN? And out of hte box pfsense will nat traffic from its lan to is wan.
For wan to get to lan you would have to seutp port fowards, or you would need to turn off natting and then just firewall, etc.
I was calling 134 LAN so that I could use the web interface on that subnet but other than that I don't think I care. But I think most people would call it the WAN since it needs the kind of forwarding for which 99.9% of the rest of the world uses NAT. That's been part of the problem for me is mapping internal/external to my problem.
I'm still parsing the rest of your sentence... thx.
-
what did you set it in pfsense? We need to know which network is what in pfsense on your 2 interfaces.
Also I attached your image to your post so its easier for the next guy.
-
@johnpoz what's the best way to share that?
-
also my first photo had a typo in the red ip address.
And the picture is slightly too big to upload so here is another link to the fixed version
https://1drv.ms/u/s!Aps0w-x8vFBjhS1M53ko07ebZFAj -
Anyway the .134.200 is the LAN and .0.200 is the WAN. I can blow it all away and swap them if you think that would help.
-
You understand its childs play to save the image in such a way that is reasonable size ;) And not MB ;)
-
So if 0.200 is WAN then for widget to get to 134 you would have to port forward.
But out of the box 134 could talk to 0 network. and to the 0 network it would look like it came from pfsense IP 0.200
-
I think that means I should flip WAN and LAN because I want .0.25 to be able to get packets to a server at .134.x
-
Then yes flip them or port forward the ports you want widget to be able to send to 134.
-
I flipped them but I am still stuck. Is there a config dump I can post?
-
Thing are looking more promising will check back with the board next week.
-
Your going to run into all kinds of problems trying to route stuff when the stuff is on physical and doesn't use pfsense as its gateway.
If pfsense is not going to be a gateway to the internet then these networks do not even need to be wan.. 1 could be pfsense lan, and the other could be opt network.
