• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Configuration of NAT Reflection to access external domain not working

Scheduled Pinned Locked Moved NAT
14 Posts 4 Posters 1.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    Derelict LAYER 8 Netgate
    last edited by Derelict Jul 24, 2018, 2:55 AM Jul 24, 2018, 2:54 AM

    It actually doesn't go through the firewall to WAN and back. It is redirected on the interface the connection is established into.

    You will probably need to post screenshots.

    Chattanooga, Tennessee, USA
    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
    Do Not Chat For Help! NO_WAN_EGRESS(TM)

    ? 1 Reply Last reply Jul 25, 2018, 1:08 AM Reply Quote 0
    • S
      SteveITS Galactic Empire
      last edited by Jul 24, 2018, 2:14 PM

      By "through pfSense" I meant a NAT connection touches pfSense. Split DNS would be when the hostname resolves to an internal IP and the connection goes direct to the LAN IP of the server and doesn't touch pfSense. Split DNS should not be necessary if NAT reflection is set up correctly...?

      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
      Upvote 👍 helpful posts!

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User @Derelict
        last edited by Jul 25, 2018, 1:08 AM

        @derelict What pages would you like to see? Port Forwards, Firewall Rules, Advanced System Settings? Something else?

        1 Reply Last reply Reply Quote 0
        • D
          Derelict LAYER 8 Netgate
          last edited by Jul 25, 2018, 1:09 AM

          Port forwards and NAT reflection settings probably.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by A Former User Jul 25, 2018, 1:54 AM Jul 25, 2018, 1:45 AM

            @Derelict

            0_1532483130748_forwards.png 0_1532483136507_nat.png

            1 Reply Last reply Reply Quote 0
            • D
              Derelict LAYER 8 Netgate
              last edited by Jul 25, 2018, 2:39 AM

              Did you get the webgui off of 80/443?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by Jul 25, 2018, 3:55 AM

                Yep. It's on 8443 now.

                1 Reply Last reply Reply Quote 0
                • D
                  Derelict LAYER 8 Netgate
                  last edited by Jul 25, 2018, 5:02 PM

                  And the WebGUI http to https redirect is disabled? Port forwards coming into WAN override that but not for NAT-reflected connections.

                  Split DNS is a more elegant solution to this problem.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  ? 1 Reply Last reply Jul 25, 2018, 9:01 PM Reply Quote 0
                  • K
                    KOM
                    last edited by Jul 25, 2018, 5:28 PM

                    +1 split DNS

                    1 Reply Last reply Reply Quote 0
                    • ?
                      A Former User @Derelict
                      last edited by Jul 25, 2018, 9:01 PM

                      @derelict said in Configuration of NAT Reflection to access external domain not working:

                      And the WebGUI http to https redirect is disabled? Port forwards coming into WAN override that but not for NAT-reflected connections.

                      Split DNS is a more elegant solution to this problem.

                      If this is what you're talking about, then no. I can change it. Let me know. I don't know that it'll have an impact since I'm only listening on 80 when I'm attempting to renew Let's Encrypt certs.
                      0_1532552291049_redirect.png

                      Did you see my second post about my Split DNS configuration? TTS for Google Home doesn't work when it is configured that way.

                      1 Reply Last reply Reply Quote 0
                      14 out of 14
                      • First post
                        14/14
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received