Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1:1 NAT Over OpenVPN Site2Site?

    Scheduled Pinned Locked Moved NAT
    3 Posts 3 Posters 947 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      p3pp0
      last edited by

      Hey Guys,

      i have two pfsense's running, which are connected via OpenVPN Site2Site. Clients on each Site can ping clients on the other side, so i guess my VPN is working fine. I have to move a server from Site A to site B.
      I could move the Server but there would be a outage because i had to change the dns record from old-public-ip to new-public ip, which is not acceptable in my case.

      My idea was to move the server in the night and to simply map the 1:1 nat to the moved server in the new lan at site B over the tunnel. If everything is working fine, i can change the dns record so that my customers can connect to my service anytime - no matter if their dns is already updated or not.

      Everything is working fine, except when i change the 1:1 nat on SITE A to the server in the lan of SITE B… my browser get's a timeout.

      Can anybody help me? Is mapping a 1:1 NAT over a tunnel generally possible?

      SITE A
      OPT1: Public IP of Webserver
      OPT2: SITE2SITE-VPN-TO-SITE-B
      LAN: 192.168.99.0/24
      IP of Client (Webserver): 192.168.99.60
      1:1-NAT FROM OPT1 to 192.168.99.60

      SITE B
      OPT1: NEW Public IP of Webserver
      OPT2: SITE2SITE-VPN-TO-SITE-A
      LAN: 192.168.199.0/24
      IP of Client (Webserver): 192.168.199.104

      1 Reply Last reply Reply Quote 0
      • S
        Soyokaze
        last edited by

        Of course it times out - your request are finely routed to Site B, where they return to original requester by shorted path they know - through WAN of Site B router.
        And requester just discards them, because it waits for them from Site A OPT1 address.
        You should create Advanced NAT rule, refer to https://forum.pfsense.org/index.php?topic=132702.msg731475#msg731475

        Need full pfSense in a cloud? PM for details!

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          You need to assign an interface to the OpenVPN instance at Site B and make sure the rules passing traffic into that OpenVPN DO NOT match anything on the OpenVPN tab but do match on the assigned interface tab. That will flag the states with reply-to so reply traffic will be sent back through OpenVPN instead of according to the routing table.

          Or just shorten the TTL on the A record in DNS to something like 5 minutes a while ahead of your move (how long depends on what your default TTL is), shut off the server, change the DNS, move the server, and by the time you get there the new address will have propagated everywhere.

          Then just set the TTL back to something reasonable and you're done.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.