NAT reflection, 1:1 VIP and NAT outbound rule to VIP

  • Hello!

    I am having a strange problem configuring the new multiple subnet setup with Virtual IPS.

    The topology is:

    pfSense x.x.7.2 public ip, Public VIPS: x.x.x.216/29 /not the same subnet as gateway/ WAN /NIC0/
    –- LAN1 PUBLIC /NIC1/
    -------- some SERVER at --> Virtual IP x.x.x.220 used by means of 1:1 NAT
    --- LAN2 STAFF /NIC2/ --> Virtual IP x.x.x.219
    --- LAN3 /VLAN on NIC1/ --> No VIP

    LAN 1 and 2 are on different hardware NICs, whole setup is hardware or VMs.

    What I need to accomplish is allow communication from LAN2 STAFF network to the SERVER on LAN1 PUBLIC using its publicly available VIP (xxx.220)

    I can easily communicate to VIP xxx.220 from the world and from within LAN1 and LAN3.

    LAN2 VIP was set up using outbound NAT rules. /pic1/
    LAN1 and LAN2 and LAN3 rules are configured the same and yet I can communicate to xxx.220 from LAN3 but not from LAN2...
    what gives? /pic2/


    8 hours later I figured out that the serwer was connected to that network on a second NIC and was confused, that's why it didnt respond.

  • Before working on VIPs, NAT, etc… I recommend taking a look at your subnets.  /20 subnets have 4096 hosts available.  Your LAN3 at is also not a valid network address.  The correct network address for that subnet would be (If you're really trying to use /20 subnets).

    If you meant /24 (aka, you might want to correct that.  A /20 subnet could probably use further segmentation if you're really working with 4k clients.

    Good luck!

Log in to reply