Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT on Local side

    Scheduled Pinned Locked Moved NAT
    14 Posts 2 Posters 755 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      meluvalli
      last edited by

      Just tried that and still no change. The rule is just ignored.

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by KOM

        It sounds like you're doing it right. Here is a guide for how to redirect DNS to pfSense. Different ports & protocols, but the basics still apply.

        https://docs.netgate.com/pfsense/en/latest/dns/redirecting-all-dns-requests-to-pfsense.html

        Test it with a packet capture running and see what's going in and going out of pfSense LAN interface.

        M 1 Reply Last reply Reply Quote 0
        • M
          meluvalli @KOM
          last edited by

          :( Ok. Well, That's actually the guide I based it off to set it up originally. I even have Nat Reflection Disabled on it like the guide says.

          I will try and look packet capturing, but I'm not sure that will do much because it'll just say my client is going out to the address of the webpage I'm accessing.

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            If you don't know what's going on then a packet capture is the only way to find out, otherwise you're just guessing and scratching your head.

            Post a screen shot of your LAN rules page.

            1 Reply Last reply Reply Quote 0
            • M
              meluvalli
              last edited by

              Here is the packets.

              09:30:27.714780 IP 10.40.162.203.53896 > 37.1.220.74.80: tcp 0
              09:30:27.869182 IP 37.1.220.74.80 > 10.40.162.203.53896: tcp 0
              09:30:27.869606 IP 10.40.162.203.53896 > 37.1.220.74.80: tcp 0
              09:30:27.869895 IP 10.40.162.203.53896 > 37.1.220.74.80: tcp 434
              09:30:28.031529 IP 37.1.220.74.80 > 10.40.162.203.53896: tcp 0
              09:30:28.039424 IP 37.1.220.74.80 > 10.40.162.203.53896: tcp 1460
              09:30:28.040341 IP 37.1.220.74.80 > 10.40.162.203.53896: tcp 1460

              1 Reply Last reply Reply Quote 0
              • M
                meluvalli
                last edited by meluvalli

                LAN.png

                1 Reply Last reply Reply Quote 0
                • KOMK
                  KOM
                  last edited by

                  Change your Source port from 80 to * in your NAT rule. Source ports are random and dynamically assigned.

                  1 Reply Last reply Reply Quote 0
                  • M
                    meluvalli
                    last edited by meluvalli

                    Made a little progress with that change... But still no go. Now I can't get out at all on port 80. Even if I go to a command prompt and try and telnet, it's like the port isn't open...

                    I tried: telnet www.google.com 80

                    Packets captured:
                    10:19:42.355820 IP 10.40.162.203.53984 > 172.217.7.228.80: tcp 0
                    10:19:42.355925 IP 10.40.162.203.53984 > 10.40.162.94.808: tcp 0
                    10:19:45.368340 IP 10.40.162.203.53984 > 172.217.7.228.80: tcp 0
                    10:19:45.368417 IP 10.40.162.203.53984 > 10.40.162.94.808: tcp 0
                    10:19:46.899623 ARP, Request who-has 10.40.162.1 (00:15:5d:a2:5a:07) tell 10.40.162.203, length 46
                    10:19:46.899654 ARP, Reply 10.40.162.1 is-at 00:15:5d:a2:5a:07, length 28
                    10:19:51.368321 IP 10.40.162.203.53984 > 172.217.7.228.80: tcp 0
                    10:19:51.368371 IP 10.40.162.203.53984 > 10.40.162.94.808: tcp 0

                    I also confirmed, I can telnet into 10.40.162.94 808. This works. So, I know it's something with the route still.

                    Also, FYI, I verified I can telnet www.google.com 80 from my Proxy machine. That works, so I know the proxy can still get out :)

                    1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM
                      last edited by

                      The redirect is working according to your capture. Did you change the Source from * back to !10.40.162.94?

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        meluvalli @KOM
                        last edited by

                        Yes. I never changed the Source IP. Only the Source port. Source port is now *. Source IP is still !10.40.162.94

                        1 Reply Last reply Reply Quote 0
                        • KOMK
                          KOM
                          last edited by

                          I don't know what your other system is doing, but the NAT is working as expected. Time to look at it from the proxy's perspective.

                          1 Reply Last reply Reply Quote 0
                          • M
                            meluvalli
                            last edited by

                            Ok. I will play more with it! I really appreciate your help!

                            I'm confused because if I manually set my proxy on my machine to 10.40.162.94, it works. So I know the proxy is functional.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.