NAT Source Hash - /24 subnet needs to exclude some addresses

[fusionp]

Hi all,

I have a questions regarding NAT and source hash, I currently have a /24 public block of IP's, at present I have them all listed in my VIP's and I use Round Robin sticky. I would now like to use Source Hash but from my /24 subnet I don't want clients getting the first 24 IP's on my public Subnet, these are reserved my services. So how can I specify source hash NAT to use just the last 230 IP's of the subnet?
tx

[Derelict]

I don't think you can. The high /25 might be the best you can do with source hash since it must be a subnet.

You could try to break up the sources into multiple outbound NAT rules with the other subnets but that sounds kind of messy.

Something like:  198.50.0.24/29, 198.50.0.32/27, 198.50.0.64/26, 198.50.0.128/25

[fusionp]

Thanks. I did consider breaking them up, and I think I might just have to do that.

[fusionp]

I went with NAT source hash subnet 3.3.3.128/25

But it looks like(at least it seems this way) that my pfsense is also giving out the Broadcast address 3.3.3.255 to some of my clients, they then obviously lose internet access. If I check the states for their private address I see this "3.3.3.255:5205 (172.16.49.160:61396) -> 8.8.8.8:53 SINGLE:NO_TRAFFIC"

Now I'm not sure if it's showing the broadcast address on the outgoing interface because this IP is failing to get out onto the internet?

So as a test I changed the NAT outbound source hash rule from subnet 3.3.3.128/25 to 3.3.3.128/26 which should give out IP's up until 3.3.3.190, and ip 3.3.3.191 is the broadcast….but after making this change and searching the states I can see that pfsense is giving out the IP 3.3.3.191, this shouldn't happen as this is the ranges broadcast address.