Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Nat and routing

    Scheduled Pinned Locked Moved Off-Topic & Non-Support Discussion
    2 Posts 2 Posters 934 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      polhallen
      last edited by

      Hi all :-) I need a small advice: my old network:

      dsl<–->server1<-->lan1 192.168.1.0/24<-->server2<--->[…]
                                      lan2 192.168.2.0/24<–>server3<--->[…]
                                      lan3 192.168.3.0/24<–>server4<--->[…]

      is this old scenario NAT was only on server1 because server1 forwarded packets over internet. Other servers were with only routing tables.

      Now server1 is became pfsense and I see automatic NAT rules (!)

      Does pfsense should be with active NAT only on wan? Why there're automatic NAT rules for all lans?

      thanks for help

      Pol

      Pol

      1 Reply Last reply Reply Quote 0
      • P
        phil.davis
        last edited by

        By default you will get automatic NAT rules for traffic from each internal LAN as it goes out WAN.
        You can change to manual NAT if you like, and then put whatever NAT rules you like (or no NAT rules).
        Since server2, server3, server4 have IPs in private address space, then I assume they only talk within your intranet (because without NAT assistance they cannot talk to public IPs). If that is so, then you probably should put block rules on lan1, lan2, lan3 to stop any packets with source server1,server2,server3 and destination public IP. If you don't do that, then the servers can still try to access public IPs, the traffic will not be NAT'd and packets with private source IPs will head out WAN. The internet routers will drop them, but it seems a waste to even send them in the first place.

        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.