NAT Source Hash - /24 subnet needs to exclude some addresses
I have a questions regarding NAT and source hash, I currently have a /24 public block of IP's, at present I have them all listed in my VIP's and I use Round Robin sticky. I would now like to use Source Hash but from my /24 subnet I don't want clients getting the first 24 IP's on my public Subnet, these are reserved my services. So how can I specify source hash NAT to use just the last 230 IP's of the subnet?
I don't think you can. The high /25 might be the best you can do with source hash since it must be a subnet.
You could try to break up the sources into multiple outbound NAT rules with the other subnets but that sounds kind of messy.
Something like: 184.108.40.206/29, 220.127.116.11/27, 18.104.22.168/26, 22.214.171.124/25
Thanks. I did consider breaking them up, and I think I might just have to do that.
I went with NAT source hash subnet 126.96.36.199/25
But it looks like(at least it seems this way) that my pfsense is also giving out the Broadcast address 188.8.131.52 to some of my clients, they then obviously lose internet access. If I check the states for their private address I see this "184.108.40.206:5205 (172.16.49.160:61396) -> 220.127.116.11:53 SINGLE:NO_TRAFFIC"
Now I'm not sure if it's showing the broadcast address on the outgoing interface because this IP is failing to get out onto the internet?
So as a test I changed the NAT outbound source hash rule from subnet 18.104.22.168/25 to 22.214.171.124/26 which should give out IP's up until 126.96.36.199, and ip 188.8.131.52 is the broadcast….but after making this change and searching the states I can see that pfsense is giving out the IP 184.108.40.206, this shouldn't happen as this is the ranges broadcast address.