NAT rules using virtual IPs do not work after a reboot
-
I recently upgraded to pfSense 2.3.2 and noticed an issue with NAT rules not working correctly after a system reboot when they are mapped using a virtual IP address.
The issue corrects itself if I navigate to my WAN interface (bridge0) and press save/apply settings (note that I do not actually have to change anything). For some reason, this action resolves the issue; however, it becomes broken again upon the next reboot and the steps above must be repeated to fix.
It looks like this was also an issue in previous versions of pfSense; however, I never noticed it as I don’t think my pfSense box was ever rebooted between implementing virtual IPs and applying 2.3.2. I was wondering if anyone else observed this behavior or is aware if it’s a known issue?
Below is some additional information about my setup in case it is relevant:
I have a subnet of public IP addresses from my ISP. Some of these addresses are configured as IP Alias/virtual IPs and some are assigned directly to other nodes on the network (using pfSense as a transparent firewall). My WAN interface consists of two physical NICs that are bridged together. I also have a LAN interface which sits behind NAT. Various machines on the LAN interface have ports mapped to them, accessible via the virtual IPs (this is where the reboot issue comes in). Please see the diagram below for additional clarification.
Diagram:
-
I have the very same issue, but there's no apply button to fix. Need to change the VIP from IP Alias to CARP and then back to get it to work.