Issue with pfSense config in Azure

  • Requesting configuration help for a pfSense setup in Azure…

    Perimeter Subnet

    • wgpfsense1 (
    • testvm (

    Web Subnet

    • WGWEB1 (

    Goal: Have testvm enter in a browser and have the traffic be directed to (standard Port Forward I think). Note that pfsense has a single interface...Azure is handling the routing.

    I have a NAT rule in place:

    If: WAN
    Protocol: TCP/UDP
    Src addr: *
    Src ports: *
    Dest. addr: WAN address
    Dest. ports: 80
    NAT IP: WGWEB1 (alias)
    NAT Ports: 80

    And a FW rule (auto-generated when NAT rule was created):

    Action: Pass
    Proto: TCP/UDP
    Source: *
    Port: *
    Dest: WGWEB1
    Port: 80

    When I try to browse from a server in the perimeter network ( to I get back ERR_EMPTY_RESPONSE.

    Packet Capture from browse attempt
    21:10:02.971756 IP > tcp 0
    21:10:02.971810 IP > tcp 0
    21:10:03.960732 IP > tcp 0
    21:10:03.960759 IP > tcp 0
    21:10:05.975642 IP > tcp 0
    21:10:05.975672 IP > tcp 0

    Firewall log from same browse attempt
    Act  Time  If  Source  Destination  Proto
    pass/1467520595, Jul 3 04:46:36, WAN,,, TCP:SEC
    pass/1467520595, Jul 3 20:20:55, WAN,,, TCP:SEC
    pass/1467520595, Jul 3 20:21:34, WAN,,, TCP:SEC
    pass/1467520595, Jul 3 21:08:51, WAN,,, TCP:SEC
    pass/1467520595, Jul 3 21:10:03, WAN,,, TCP:SEC

    Wireshark trace from the web server traffic should be redirected to ( shows no packets with tcp.port eq 80 and ip.src==

    Its like the packets aren't getting to the web server at all, even though the firewall rule allows and the NAT is set up.

    If, from I open a browser and type in the web server address directly ( I get the site returned fine. This proves to me that the Azure fabric is routing the packets from the to the subnet.

    Questions: Did I miss anything in the NAT setup? Shouldn't the pfSense appliance send packets to its default gateway not on its own subnet (Gateway IPv4 Is there other diagnostic data I can look at or provide?

    Thanks in advance,

Log in to reply