1:1 NAT not BINATing
-
Just recently got pfSense up and running. I have a Class C public WAN and run web servers and a couple email servers inside the DMZ. However, I want my email server to go out its public IP instead of the pfSense's WAN IP. So I --
-- created a virtual IP for the email server public IP
-- created a 1:1 mapping between the email public IP and the email DMZ IP
-- created a firewall rule to allow all normal email ports into the email DMZ IP
-- disabled previous, normal NAT rules I had set up for the email server.However, emails still show as coming from the pfSense WAN IP rather than the public IP of the email server.
Have I missed something?
-
Looks good.
What do you mean by shows as coming from? What are you looking at?
-
I was looking at the mail header of an email I sent. Having the FQDN of the email server consistent with the IP address it looks like it's coming from is important.
However, I seem to have bigger problems. It turns out that I tested before the filter reloaded. The filter was hung up on pfBlocker. Once it completed, the email server had no communication through the WAN. I disabled the 1:1 NAT, enabled the normal NAT and WAN access began again.
If anyone has some advice, I'd be grateful. I've been reading as much as possible but I must be missing some obvious step.
-
I had to manually set an outbound NAT for my 1:1 NAT's, it doesn't seem to be doing what it's supposed to automatically.
When I was setting up some dedicated static IPs for my Xboxs I had to set my outbound to hybrid/manual and set up the rules as Auto and Hybrid didn't seem to pick up the 1:1 and create the rules automatically. -
1:1 does not create any firewall pass rules automatically. You have to do it. All it does is set up the BINAT.
-
Solved! Since I'm a newbie to pfSense, I made a simple mistake. The 1:1 NAT was fine, but in my manual firewall rule I entered the public IP rather than the DMZ IP. Everything is working now include BINAT. Thanks for your help and patience!
