Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [solved] NAT with unassigned destination IP

    Scheduled Pinned Locked Moved NAT
    14 Posts 4 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kpa
      last edited by

      Please draw a network  diagram of what is located where in the scenario. I understood zero of your description.

      1 Reply Last reply Reply Quote 0
      • F
        FrauBlucher
        last edited by

        @kpa:

        Please draw a network  diagram of what is located where in the scenario. I understood zero of your description.

        I'll do what I can… meanwhile, In the hope to clarify my main question, the iptables rule I'm trying to migrate in pfsense is:

        $IPTABLES -t nat -A PREROUTING  -s $source_ip  -d $lan_ip  -j DNAT --to-destination $another_ip
        
        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          "but WAN has its own routing"

          You mean the devices in your wan network do not use pfsense wan IP as their default gateway, and you want stuff in this wan network to be able to get to some network behind pfsense.  And you can not touch the routing table of the device in wan network?

          So in a nutshell you have this - with example networks..  So your wan 192.168.0 uses a different gateway than pfsense wan IP lets call it 192.168.0.254.. And you want these devices in wan to be able to get to something in say 192.168.2/24?

          yournetwork.png
          yournetwork.png_thumb

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • F
            FrauBlucher
            last edited by

            Thank you very much for the drawing!

            @johnpoz:

            You mean the devices in your wan network do not use pfsense wan IP as their default gateway, and you want stuff in this wan network to be able to get to some network behind pfsense.  And you can not touch the routing table of the device in wan network?

            So in a nutshell you have this - with example networks..  So your wan 192.168.0 uses a different gateway than pfsense wan IP lets call it 192.168.0.254.. And you want these devices in wan to be able to get to something in say 192.168.2/24?

            It's a little bit different (I'll use names and subnets of your drawing), the 192.168.0/24 has another gw/router before arriving to PfS Wan inteface and the only traffic allowed to get there is for the subnet 192.168.1/24.

            So what I did with the previous gw was to NAT all traffic to a specific 192.168.1/24 address to the server on 192.168.2/24

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              So you have something like this?

              And this other router is also natting between what I show as 192.168.0 and 192.168.3?

              Please draw your network so we can all be on the same page of what your trying to do and where you have nats and what routes and default gateways you have on what devices, etc.

              newdrawing.png
              newdrawing.png_thumb

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • F
                FrauBlucher
                last edited by

                @johnpoz:

                Please draw your network so we can all be on the same page of what your trying to do and where you have nats and what routes and default gateways you have on what devices, etc.

                I've attached a drawing.

                Quick recap using network subnets of my drawing:

                • the issue: 192.168.70.0/24 should reach a server in 10.1.100.0/24

                • the gateway of 192.168.70.0/24 (not managed by me) doesn't know about 10.1.100.0/24, to him my pfsense manages only 172.20.1.0/24

                • in the previous appliance (using iptables) we were doing it with a rule like: $IPTABLES -t nat -A PREROUTING  -s 192.168.70.0/24  -d 172.20.1.214  -j DNAT –to-destination 10.1.100.214

                ns.png
                ns.png_thumb

                1 Reply Last reply Reply Quote 0
                • V
                  viragomann
                  last edited by

                  @FrauBlucher:

                  • in the previous appliance (using iptables) we were doing it with a rule like: $IPTABLES -t nat -A PREROUTING  -s 192.168.70.0/24  -d 172.20.1.214  -j DNAT –to-destination 10.1.100.214

                  So you had 172.20.1.214 assigned as a virtual IP on the previous routers interface connected to 192.168.20.1/24 and simple forwarded it to 10.1.100.214.

                  To do that on pfSense, go to Firewall > Virtual IPs and assign 172.20.1.214 as "IP Alias" to the proper interface.

                  Then add a port forwarding rule in "Firewall > NAT". Again select the proper interface, the protocol you need, at source hit "display advanced", select Network and enter 192.168.70.0/24, at destination select the virtual IP you've added before and at "redirect target" enter 10.1.100.214, below you may set a description, save the rule.

                  Now it should behave the same way as with the previous router.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Yup viragomann hit it right on the head and beat me to the punch ;)

                    Nice drawing btw - see how easy and clear now everyone understands how you had it setup and makes more sense.

                    But to be honest why could you not just use the IP that pfsense has on its wan as the dest, or create a vip in that transit network between the router and pfsense.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • V
                      viragomann
                      last edited by

                      Yeah, a simple drawing says more then 1000 words.  ;)

                      1 Reply Last reply Reply Quote 0
                      • F
                        FrauBlucher
                        last edited by

                        Thank you viragomann and johnpoz!

                        @viragomann:

                        To do that on pfSense, go to Firewall > Virtual IPs and assign 172.20.1.214 as "IP Alias" to the proper interface.

                        This is the information I was missing: the rule was correct but I didn't know I had to configure a IP alias for that.

                        The complete resolution (should anyone be in this situation) included also creating a outbound nat rule I forgot about (to manage the return path from 10.1.100.214 back to 192.168.70.0/24)

                        @johnpoz:

                        Nice drawing btw - see how easy and clear now everyone understands how you had it setup and makes more sense.

                        But to be honest why could you not just use the IP that pfsense has on its wan as the dest, or create a vip in that transit network between the router and pfsense.

                        I couldn't use the wan interface or the transit network for multiple reasons:
                        first: I simplified my network topology, I actually have three situation like this to manage (think other two PfS optX interfaces with other subnets) and some of the servers are ftp servers so I'd rather have one virtual ip with all ports forwarded to a particular server (opposed to: single virtual ip with different NATs on different ports).
                        second: the transit network is really a transit network: it's a /29 subnet with almost no unassigned ip and that particular subnet it's managed by their router and my pfsense (its addressing it's opaque to my lan and the wan)

                        Sorry about the delay with the drawing and the issues with the descriptions (english is not my first language), in the future I'll start threads only if I have a drawing ready :)

                        Thanks again

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          "the transit network is really a transit network: it's a /29 subnet with almost no unassigned ip"

                          Then why would you show it as a /24?

                          Going forward be as accurate as possible - there have been so many times that thread drags on because info given by the user is just not correct.  Or they forget to say they are using proxy or captive portal, etc. etc… Correct info is a requirement to finding the problem..

                          This is why screenshot of rules and configs are best vs some one saying yeah I have port forward xyz or yup the rule is any any.. When you come to find out they had put in some source port on their port forward or the any any rule was tcp only, etc.

                          Or sure they do the port forward but they have block rule ahead of it on the wan, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • F
                            FrauBlucher
                            last edited by

                            @johnpoz:

                            "the transit network is really a transit network: it's a /29 subnet with almost no unassigned ip"

                            Then why would you show it as a /24?

                            Going forward be as accurate as possible - there have been so many times that thread drags on because info given by the user is just not correct.  Or they forget to say they are using proxy or captive portal, etc. etc… Correct info is a requirement to finding the problem..

                            The transit network was not actually showed in my drawing: as I said, I simplified some things, but I get your point. I only thought that reporting our whole network topology seemed a little overkill since the main question was on how to migrate a (pre exisiting and functioning) nat rule.

                            Anyway: ok, message received, won't happen again.

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Per your drawing that 172.20.1/24 is clearly a TRANSIT network…

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.