Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Dual WAN - Setting 1:1 NAT Causes not able to ping out.

    Scheduled Pinned Locked Moved Routing and Multi WAN
    1 Posts 1 Posters 458 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bacon8tor
      last edited by

      I have 2 ISP , a LAN and DMZ , version 2.3.3 fresh install
      ISP 1 - 1.1.1.1/27    -  WAN
      isp 2 - 2.2.2.2/28    -  WAN2
      lan 10.10.10.1/24    - LAN
      DMZ 10.9.8.1/24    - DMZ

      Firewall rules are as follows (basically allow LAN to any , and block DMZ from LAN, and allow DMZ to any after that.
      I have a gw group setup with the trigger at packet loss or high latency.

      LAN

      
      States	Protocol	Source	Port	Destination	Port	Gateway	Queue	Schedule	Description	Actions
      0 /1.09 MiB 
      *	*	*	LAN Address	80	*	*		Anti-Lockout Rule	
      19 /10.61 MiB
      IPv4 TCP/UDP	*	*	*	*	*	none	 		    
      		0 /0 B
      IPv4 TCP/UDP	LAN address	*	LAN address	*	*	none	 	lan any	    
      		0 /15 KiB
      IPv4 *	LAN net	*	*	*	*	none	 	Default allow LAN to any rule	    
      		0 /0 B
      IPv6 *	LAN net	*	*	*	*	none	 	Default allow LAN IPv6 to any rule	    
      
      

      DMZ

      
      	States	Protocol	Source	Port	Destination	Port	Gateway	Queue	Schedule	Description	Actions
      		0 /0 B
      IPv4 *	DMZ net	*	LAN net	*	*	none	 	BLOCK DMZ to LAN	    
      		1 /3.78 MiB
      IPv4 *	DMZ net	*	*	*	*	none	 	DMZ to ANY	
      
      ```   
      
      I am able to ping google.com as it stands, but I need to set external IP to a machine on the DMZ, once I set a 1:1 the server  on the DMZ is unable to ping out.
      
      Before 1:1 NAT
      

      it@ispconfig:~$ ping google.com
      PING google.com (216.58.219.14) 56(84) bytes of data.
      64 bytes from lax17s03-in-f14.1e100.net (216.58.219.14): icmp_seq=1 ttl=54 time=11.8 ms
      64 bytes from lax17s03-in-f14.1e100.net (216.58.219.14): icmp_seq=2 ttl=54 time=11.8 ms
      64 bytes from lax17s03-in-f14.1e100.net (216.58.219.14): icmp_seq=3 ttl=54 time=11.8 ms
      ^C
      --- google.com ping statistics ---
      3 packets transmitted, 3 received, 0% packet loss, time 2003ms
      rtt min/avg/max/mdev = 11.865/11.880/11.890/0.126 ms
      it@ispconfig:~$ traceroute google.com
      traceroute to google.com (216.58.219.14), 30 hops max, 60 byte packets
      1  10.9.8.1 (10.9.8.1)  0.221 ms  0.199 ms  0.255 ms
      2  1.1.1.1 (1.1.1.1)  0.569 ms  0.622 ms  0.620 ms
      3  216.2.140.117 (216.2.140.117)  1.851 ms  1.851 ms  1.872 ms
      4  216.156.16.32.ptr.us.xo.net (216.156.16.32)  11.996 ms  11.988 ms  12.042 ms
      5  207.88.12.222.ptr.us.xo.net (207.88.12.222)  12.064 ms  12.104 ms  12.092 ms
      6  207.88.13.27.ptr.us.xo.net (207.88.13.27)  12.205 ms  11.930 ms  11.961 ms
      7  216.0.6.42 (216.0.6.42)  11.719 ms  11.799 ms  12.628 ms
      8  108.170.247.193 (108.170.247.193)  11.934 ms 108.170.247.225 (108.170.247.225)  11.896 ms 108.170.247.193 (108.170.247.193)  11.959 ms
      9  108.170.237.143 (108.170.237.143)  12.023 ms  12.082 ms 108.170.237.141 (108.170.237.141)  12.039 ms
      10  lax17s03-in-f14.1e100.net (216.58.219.14)  12.005 ms  11.959 ms  11.923 ms

      
      After setting 1:1 NAT as follows
      Interface : WAN
      External Subnet : 1.1.1.3
      internal IP: Single Host 10.9.8.15
      Destination : Any
      
      Once I submit this and try to traceroute I get this
      
      

      it@ispconfig:~$ traceroute google.com
      traceroute to google.com (216.58.219.14), 30 hops max, 60 byte packets
      1  10.9.8.1 (10.9.8.1)  0.307 ms  0.310 ms  0.325 ms
      2  * * *
      3  * * *
      4  * * *
      5  * * *
      6  * * *

      
      this happens on the 2 machines I have in the DMZ Net. As soon as I delete this 1:1 nat it begins working again.
      I have been struggling with this for 2 days now, ANy help would be much appreciated. if any addt'l info is needed let me know ill post ASAP.
      Thanks in advanced.
      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.