NAT Source Hash - /24 subnet needs to exclude some addresses
I have a questions regarding NAT and source hash, I currently have a /24 public block of IP's, at present I have them all listed in my VIP's and I use Round Robin sticky. I would now like to use Source Hash but from my /24 subnet I don't want clients getting the first 24 IP's on my public Subnet, these are reserved my services. So how can I specify source hash NAT to use just the last 230 IP's of the subnet?
I don't think you can. The high /25 might be the best you can do with source hash since it must be a subnet.
You could try to break up the sources into multiple outbound NAT rules with the other subnets but that sounds kind of messy.
Something like: 188.8.131.52/29, 184.108.40.206/27, 220.127.116.11/26, 18.104.22.168/25
Thanks. I did consider breaking them up, and I think I might just have to do that.
I went with NAT source hash subnet 22.214.171.124/25
But it looks like(at least it seems this way) that my pfsense is also giving out the Broadcast address 126.96.36.199 to some of my clients, they then obviously lose internet access. If I check the states for their private address I see this "188.8.131.52:5205 (172.16.49.160:61396) -> 184.108.40.206:53 SINGLE:NO_TRAFFIC"
Now I'm not sure if it's showing the broadcast address on the outgoing interface because this IP is failing to get out onto the internet?
So as a test I changed the NAT outbound source hash rule from subnet 220.127.116.11/25 to 18.104.22.168/26 which should give out IP's up until 22.214.171.124, and ip 126.96.36.199 is the broadcast….but after making this change and searching the states I can see that pfsense is giving out the IP 188.8.131.52, this shouldn't happen as this is the ranges broadcast address.