PFSense logging my own public IP as SourceIP on all packets
-
Yeah, the only idea is to get rid of the double NAT.
Disabled NAT on PFSense and have a port forward on the ISP modem to the backend webserver. No NAT on PFsense, just routing and firewall rules.
Still the same problem. This is weird.
-
pfSense, by default, does not translate source addresses on inbound connections like that unless you get into outbound NAT on LAN, which you have to try pretty hard to do. Maybe it's your ISP modem doing it? Packet capture on WAN and see.
-
pfSense, by default, does not translate source addresses on inbound connections like that unless you get into outbound NAT on LAN, which you have to try pretty hard to do. Maybe it's your ISP modem doing it? Packet capture on WAN and see.
Yea, I have had a "double-nat" setup before and never had this problem (be it PFSense, websever or whatever). At our previous house our fiber modem was a bridge, so PFSense just got the public IP.
It would seem it's an ISP "issue". Not a major deal breaker and I'll have to live with it, but good logdata is nice to have.
Thanks for the repsonses.
-
that has to be their device doing that.. Pfsense can only log what it sees.. If the ips device that is sending the traffic to pfsense is source natting.. You will have to get with your ISP..
-
that has to be their device doing that.. Pfsense can only log what it sees.. If the ips device that is sending the traffic to pfsense is source natting.. You will have to get with your ISP..
Yea, the ISP hopeless. Really don't like them compared to my old ISP. It's definately not a PFSense issue, but i thought I'd ask in here anyway.
I've managed to find the admin password for their modem on the net, so I'm going to try and force a bridge and spoof the modems MAC. Maybe I can get a functional bridge working.
If not, then I'll just have to put up with bad logdata.
If i find a solution I'll write a new post.
-
If you can not put it into bridge mode.. How about if you don't use their dmz host setting and just do a standard port forward to whatever ports you want to forward on pfsense. Them doing a snat on traffic that hits your public IP seems very very ODD..
While I agree most of the 1st or even 2nd level help is worthless, many are just reading off scripts - when you go off script they are completely lost.. I would try and escalate to a level 3 or higher tech. Do a sniff on pfsense wan showing that its snat all the connections to your machine so you can send this to their higher level support.
To me yes I agree this is a very broken configuration for such a setup. Now in a corp network or something you may need to source nat some of your connections, etc. But for a public internet connection seems like really bad idea.. How could you ever create filters on your pfsense box for specific public IPs to either allow or block connections? And as you have already noticed your logs are useless in such a setup.
-
A raw packet capture on the WAN interafce of PFsense just shows my public IP as the source. I've spent more than 3 nights trying to solve it, så i'm completely clueless.
I'll have to find their contact information and find out if it's possible. The biggest problem i have is that they don't want to listen when it involves forwarded ports….
-
After a while I managed to find an email address on the ISP site as they only offer chat or phone for support normally.
Anyhow, email sent with some log data. Lets hope they reply. But i think it's unlikely I'll get a decent answer. But we gave it a shot, hope for the best :).
-
So did you try turning off the dmz host mode and just forwarding specific ports, like 80 or 443, 22 and test the specific ports.. Does it source nat as well? If so that is just MESSED UP!!
Do you have any other choices for isp? If so freaking tell them your moving to different ISP and see if that gets their attention.
-
So did you try turning off the dmz host mode and just forwarding specific ports, like 80 or 443, 22 and test the specific ports.. Does it source nat as well? If so that is just MESSED UP!!
Do you have any other choices for isp? If so freaking tell them your moving to different ISP and see if that gets their attention.
I did try just forwarding specific ports, but it was the same. No difference. I can't figure it out. I've never had this problem before with any previous ISP.
Once explanation is that our house was built this year and it's all new infrastructure. So maybe they are still smoothing out the bugs. I'm hoping that's the case anyway.
Unfortunately ISPs usually have a monopoly in specific neighborhoods. So where i live they are the only option. The only way to change ISP is to move house.
