Switching from Sonicwall NSA 4600 to a pfsense box

pjaneiro

@daddygo Hmm, not sure if I understand your post here, My post is about needing help trying to decipher what portions of the sonicwall nat rules are relevant to PFSense

DaddyGo

@pjaneiro said in Switching from Sonicwall NSA 4600 to a pfsense box:

what portions of the sonicwall nat rules are relevant to PFSense

Okay, ALL because NAT rules don’t depend on what device you're applying to

if you need them you need to set them up

pjaneiro

Bump Bump, just checking to see if anyone here has experience in this and has actual insight

DaddyGo

@pjaneiro said in Switching from Sonicwall NSA 4600 to a pfsense box:

anyone here has experience in this and has actual insight

nothing serious happened

Everyone wants to get the job done easily, okay.
In this case, you need to do it manually, sorry.

NAT is NAT, wherever it is set up...
(so anyone who deals with firewalls or routing must have an insight into this)

I would do, -examine and collect the predefined NAT rules of the stupid Sonicwall one by one.
I would then create it in "edible" form in pfSense.

There is no better way and I know there will be a lot of work.

I am with you in spirit, if you need help when you activate them (NAT rules) with pfSense, you can find us here.

pjaneiro

@daddygo

Not wanting to get the job done for me or easily, I'm asking for help in transcoding what means what

like you wrote -

I would do, -examine and collect the predefined NAT rules of the stupid Sonicwall one by one.
I would then create it in "edible" form in pfSense.

This is what I am trying to do, but on the pfsense half the crap on the sonicwall is not there
source original - source translated / destination original - destination translated

If i look on the pfsense, if i try to match those rules, nothing works, so if there is a table somewhere where there are comparable rules that have been translated from a sonicwall to a pfsense that would be awesome and i'll be able to do the rest

SteveITS

Here's an example for HTTPS:

By default pfSense creates a firewall rule allowing the traffic ("Filter rule association" at the bottom of the page).

DaddyGo

@pjaneiro said in Switching from Sonicwall NSA 4600 to a pfsense box:

nothing works, so if there is a table somewhere where there are comparable rules that have been translated

Hi,

No one can do more for you than that, everyone learned pfSense from this book
https://docs.netgate.com/pfsense/en/latest/nat/index.html

Of the Youtube stuff, I only recommend him:
https://www.youtube.com/watch?v=eb1pTs7XamA

of course:
https://www.youtube.com/channel/UC3Cq2kjCWM8odzoIzftS04A/videos

There are no explicit migration tool or instructions from Sonicwall to pfSense, or I have never met one...

pjaneiro

@steveits I'm looking at what you highlighted

And this is where I get really confused, All my rules and port forwarding are done

so my issue is what goes where here when I look at one set of my sonicwall rules for one of my services

this is where I do not quite grasp where what goes where

Since I do not transform my services (ports) I don't need worry about that

And I also know that rule that starts with firewalled subnets is the loopback rule, but that also confused the heck outta me, Is a loopback rule necessary for pfsense ?

SteveITS

Are you trying for inbound NAT redirection (RouterWAN:443 -> WebServerLAN:443) or outbound NAT? Those are very different and your screen cap is for outbound. Outbound makes the outgoing packet use a different IP address, useful for instance if one has 1:1 NAT mapping and the outbound connection should use that IP not the default IP.

pjaneiro

@steveits

Basically I have about 40 ip wan adresses, let's say someone from the outside is hitting one of my public servers at 2.2.2.2, pfsense should know that when wan IP 2.2.2.2 receives a packet it should be redirected to internal private ip 10.1.1.1 and when private ip 10.1.1.1 answer back the outside world should see that 2.2.2.2 is answering and not my firewall that has an ip of 2.2.2.7

Am i writing this ok or did i screw the pooch i my explanation ?

SteveITS

You're OK. So inbound would likely be 1:1 NAT then.

Our setup is old, but for Outbound probably either Hybrid or Manual with a manual entry for each server:

Source: 10.1.1.1/32
Destination: any (the Internet)
NAT Address: 2.2.2.2