Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to do use this NAT?

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    36 Posts 3 Posters 3.8k Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A Offline
      akong77
      last edited by

      So, I should set 192.168.13.2 to pfsense1 wan interface and 192.168.13.3 to pfsense2 wan interface.
      Then I set 192.168.13.4 to Firewall--Virtual IPs--CARP.
      And 1.2.3.4 this IP set on Firewall--Virtual IPs--IP Aliases. Is it correct?

      1 Reply Last reply Reply Quote 0
      • V Offline
        viragomann
        last edited by

        Yes, for 1.2.3.4 and all other public IPs select type "IP Alias" and at interface select "192.168.13.4", which is the CARP VIP.

        A 1 Reply Last reply Reply Quote 0
        • A Offline
          akong77
          last edited by

          Hello,
          Thank you teach us.
          I want know two question.
          WAN interface I has set 192.168.13.2.The upstream gateway should be set none. Is it correct?
          Outbound NAT the NAT address set should use public ip address e.g. 1.2.3.4. Is it correct?

          1 Reply Last reply Reply Quote 0
          • DerelictD Offline
            Derelict LAYER 8 Netgate
            last edited by

            If it is a WAN and you want it to act like a WAN you should set the upstream gateway on the interface.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            A 1 Reply Last reply Reply Quote 0
            • A Offline
              akong77 @viragomann
              last edited by

              @viragomann
              WAN interface I has set 192.168.13.2.The upstream gateway should be set none. Is it correct?
              Outbound NAT the NAT address set should use public ip address e.g. 1.2.3.4. Is it correct?

              V 1 Reply Last reply Reply Quote 0
              • A Offline
                akong77 @Derelict
                last edited by

                @Derelict
                Thanks a lot.
                Because I will set private ip on wan. So I need understand this setup.Thanks a lot.

                1 Reply Last reply Reply Quote 0
                • V Offline
                  viragomann @akong77
                  last edited by

                  @akong77
                  As @Derelict already mentioned, if it is the WAN interfaces facing to your upstream gateway, you should state the gateway here (1.2.3.254).

                  Yes the outbound NATs translation address has to be one of your public IPs like 1.2.3.4.

                  A 1 Reply Last reply Reply Quote 0
                  • A Offline
                    akong77 @viragomann
                    last edited by

                    @Derelict @viragomann Thanks all friend.
                    But it's can't monitor internet ip status if I set private ip on wan. Right?
                    I want know if I use multi wan with carp. What do I want to know?

                    1 Reply Last reply Reply Quote 0
                    • V Offline
                      viragomann
                      last edited by

                      You can configure the gateway monitoring to use an alternative (public) IP.
                      Edit the gateway settings in System > Routing > Gateways and enter a public IP which responses to ICMP into the "Monitor IP" box.

                      A 1 Reply Last reply Reply Quote 0
                      • A Offline
                        akong77 @viragomann
                        last edited by akong77

                        @viragomann I has use alternative (public) IP like 1.1.1.1 this ip address to monitor.I also test diag--ping to test wan. It's can ping to 1.1.1.1 this ip address.But it's always show offline.How to set monitor ip use ICMP?

                        1 Reply Last reply Reply Quote 0
                        • DerelictD Offline
                          Derelict LAYER 8 Netgate
                          last edited by

                          Monitor pings every half-second by default. This is an ICMP echo request looking for an echo reply. Not sure what you're asking.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • A Offline
                            akong77
                            last edited by

                            My Wan is set private ip use 192.168.15.2/24 and set gateway is 61.220.69.254. This gateway ip is true. And I can ping to anywhere. But monitor always show offline.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD Offline
                              Derelict LAYER 8 Netgate
                              last edited by

                              Then pings to the monitor IP address are not being returned.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              A 1 Reply Last reply Reply Quote 0
                              • A Offline
                                akong77 @Derelict
                                last edited by

                                @Derelict So if I use private ip at WAN interface. The monitor is show offline is normal?

                                1 Reply Last reply Reply Quote 0
                                • DerelictD Offline
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Yes. That is why you need three routable IP addresses to do HA correctly. Else only the node that holds the CARP address can access the internet.

                                  If it is worth HA it is worth doing correctly.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • A Offline
                                    akong77
                                    last edited by

                                    Hello, I have two wan interface. I has set private ip on two wan interface. It's can ping outgoing on pfsense. I has set default gateway. But client pc only go default gateway to internet. If client pc set outbound NAT to none default gateway. It's can't go to internet. How to set up it?

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD Offline
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      No idea based on that description. Sorry. Please post more details.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • A Offline
                                        akong77
                                        last edited by

                                        Sorry.
                                        WAN1 -- 192.168.15.2/24 and gateway set to 1.2.3.254
                                        WAN1 have five CARP IPs.
                                        WAN2 -- 192.168.20.2/24 and gateway set to 5.6.7.254
                                        WAN2 have file CARP IPs.
                                        LAN1 -- 192.168.0.0/24
                                        LAN2 -- 192.168.10.0/24
                                        Outbound NAT set LAN1 to WAN2 CARP IP. Set LAN2 to WAN1 CARP IP.
                                        I set default gateway as WAN2.
                                        It's only LAN1 user can go to internet. LAN2 user can't go to internet.
                                        If I set default gateway is WAN1.
                                        It's only LAN2 user can go to internet. LAN1 user can't.
                                        How to set it?

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD Offline
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          You do not route traffic with Outbound NAT rules. You route traffic with policy routing rules.

                                          Set your Outbound NAT for all inside source addresses on both WANs to the proper CARP VIP.

                                          Policy routing determines what traffic flows out which interface.

                                          https://docs.netgate.com/pfsense/en/latest/book/multiwan/policy-routing-configuration.html#policy-routing-configuration

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • A Offline
                                            akong77
                                            last edited by

                                            So in addition to setting the Outbound NAT to the CARP IP, also set the Gateway in LAN1 and LAN2's Rules, right?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.