Pure NAT vs NAT+proxy
-
Hi Guys,
I just updated to 2.3.1. Before the update I could access my local servers websites via their domain names without issue. After the update I can still assess them but cant write any data or log into any websites.
I can fix my problem by changing NAT+proxy to Pure NAT. My concern is I don't know what the setting was on before I upgraded and if changing to Pure NAT will affect any plugins or other configurations etc. I'm also curious if NAT+proxy is better/safer than Pure NAT and if so would I be better to change my configuration?
Thanks in advance.
Baldman.
-
Ok, It looks like I spoke to soon. Some things work with Pure NAT and some things don't. I have been using pfsense for years and I have never had this problem. Something must have changed from 2.2.6 to 2.3.1. I feel like I shouldn't have updated. I've seen a few post on here regarding similar issues but I haven't found a solution yet. Any help would be appreciated?
-
Did you check the box "Enable automatic outbound NAT for Reflection" the reflection options?
-
Yes just now and it didn't work. I cant figure out what's changed since I updated.
-
Any other ideas?ā¦... ???
-
I have same issue.
Looks like many forum posts talk about this, but none have an answer. Replying to this one as it is most simple explanation and yet is accurate to my issue.
If I am on internal network and ask to communicate with a public IP that my pfsense router managesā¦.
I would expect pfsense to recognize it owns the IP, and then pfsense to redirect traffic back into the network and show source address as public WAN address.
Unfortunately while it does redirect, it shows the source IP as the pfsense router's LAN IP... not the public WAN address like it should.
I am on 2.4.3 pfsense
-
That's a normal behaviour with a proxy server. On the destination device you only see the IP of the proxy and that is the interface IP of pfSense which is facing to the destination device. What else?
To see the WAN IP makes no sense over all. The WAN IP may be the origin destination IP but never the source IP.
