1:1 NAT not BINATing



  • Just recently got pfSense up and running. I have a Class C public WAN and run web servers and a couple email servers inside the DMZ. However, I want my email server to go out its public IP instead of the pfSense's WAN IP. So I --

    -- created a virtual IP for the email server public IP
    -- created a 1:1 mapping between the email public IP and the email DMZ IP
    -- created a firewall rule to allow all normal email ports into the email DMZ IP
    -- disabled previous, normal NAT rules I had set up for the email server.

    However, emails still show as coming from the pfSense WAN IP rather than the public IP of the email server.

    Have I missed something?


  • Netgate

    Looks good.

    What do you mean by shows as coming from? What are you looking at?



  • I was looking at the mail header of an email I sent. Having the FQDN of the email server consistent with the IP address it looks like it's coming from is important.

    However, I seem to have bigger problems. It turns out that I tested before the filter reloaded. The filter was hung up on pfBlocker. Once it completed, the email server had no communication through the WAN. I disabled the 1:1 NAT, enabled the normal NAT and WAN access began again.

    If anyone has some advice, I'd be grateful. I've been reading as much as possible but I must be missing some obvious step.



  • I had to manually set an outbound NAT for my 1:1 NAT's, it doesn't seem to be doing what it's supposed to automatically.
    When I was setting up some dedicated static IPs for my Xboxs I had to set my outbound to hybrid/manual and set up the rules as Auto and Hybrid didn't seem to pick up the 1:1 and create the rules automatically.


  • Netgate

    1:1 does not create any firewall pass rules automatically. You have to do it. All it does is set up the BINAT.



  • Solved! Since I'm a newbie to pfSense, I made a simple mistake. The 1:1 NAT was fine, but in my manual firewall rule I entered the public IP rather than the DMZ IP. Everything is working now include BINAT. Thanks for your help and patience!


 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy