NAT Trouble with CARP



  • Hello everybody!

    We are facing strange behavior with our pfsense HA Cluster:

    Outbound-NAT on the Master (which is replicated to the slave as well), is set to Manual (AON).
    We configured for each vlan:

    | Interface | Source | Source Port | Destination | Destination Port | NAT Address | NAT Port | Static Port |
    |
    |
    | WAN | 192.168.100.0/24 | * | * | * | CARP-VIP (193.x.y.z) | * | randomize port |
    | WAN | 192.168.100.0/24 | * | * | 500 | CARP-VIP (193.x.y.z) | * | static port |

    Now, when i apply these settings to the pfsense (lates version 2.4.0-RELEASE) and then go to one of my VLAN Clients, it comes to crazy dl/ul values.
    Our Machines (NEMONIX servers) are equiped with 10GB copper cards. We have also gigabit uplinks connected to it.
    We do not use any limiters or traffic shaping.

    using the AON (manual) config i get

    BUT when i switch to Automatic NAT (which does not use our outbound NAT VIP for sure) i get:

    (download is limited by some network hardware seemingly haha)

    can anybody explain to me WHY?
    If you need to see any further config let me know

    thanks and have yourselves a nice day !


  • Netgate

    Probably something to do with your upstream and that other IP/MAC address. pfSense does not care.



  • @Derelict:

    Probably something to do with your upstream and that other IP/MAC address. pfSense does not care.

    what would the upstream has to do with the other IP/MAC? Sorry but I dont get what you mean  ???  :-\


  • Netgate

    Hard to say. But if the only difference is the CARP address being used for NAT that is where I would look.

    ISPs do crazy things.

    Also, you want to move that static port 500 NAT rule above the rule since, if left like that, it will never be matched. Unrelated to your speed issue. Just sayin'.