Routing issue
-
I'm hoping someone can help me with a routing problem I have.
My pfsense firewall has 4 interfaces:
WAN - goes to ISP for internet
LAN - internal home network
3rd and 4th interface are configured in a LAG using LACP and have 6 VLANs setupFrom the LAN network I can browse the internet and all works fine. I can also connect to servers from the LAN to any server in any of the VLANs. Routing from the VLANs to the LAN works fine too.
The problem is that from any of the VLANs I can't browse the internet over the LAG/LACP. When I do a trace route from one of the servers in the VLAN it gets to the default gateway and then times out. When doing a trace route from the firewall using the LAN interface the trace route works correctly but when selecting one of the VLAN interfaces the trace route times out.
I've had a look at the gateways and routes but I am lost as to why the VLANs won't route to the internet. I have temporary firewall rules allowing all outgoing traffce so I'm 99% sure its a route issue thats causing this.
Any ideas? Thanks!
-
do you have manual outbound NAT enabled ? if yes: you need to create nat rules
if no: more info required
-
THanks for the reply. Yes, it was the outbound NAT rules that I needed to create. Once this was done the internet worked.
Stupid question but why are these needed when you have firewall rules to allow/deny access? Are the outbound NAT rules another layer of security? I'm just trying to figure out the point they serve….
-
As traffic is routed out an interface those rules determine how the source IP address and port are mapped.
There are many uses for them a few:
Sourcing traffic from a VIP instead of the interface address
Not performing NAT at all if the inside addresses are routable/public
Using a pool of source addresses in high-volume environments
Setting static source ports for services that require it
