Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1:1 NAT not working. Replacing Checkpoint with Pfsense

    Scheduled Pinned Locked Moved NAT
    19 Posts 3 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Su30MKI
      last edited by Su30MKI

      Hello All I am replacing checkpoint with pfsense. I have made a change by creating a separate DMZ network form Pfsense with one way traffic from LAN to DMZ.

      • I have 15 usable IPs, I created IP alis VIP for the usable IPs and did 1:1 NAT to the DMZ internal host.
      • But the DMZ servers are unable to connect
      • But the domain name gets reply from the usable IP set as IP alias VIP.
        I have attached the network layout plan I implemented along with the NAT and rules for the DMZ host.0_1534412455227_Layout.jpg 0_1534412737609_NAT-WAN Rule.PNG 0_1534412742217_Ping_Result.PNG0_1534412801060_NAT1-to-1.PNG
      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Going to be pretty much impossible to see what you are doing with those addresses obfuscated like that.

        This might help:

        https://www.netgate.com/docs/pfsense/book/firewall/methods-of-using-additional-public-ip-addresses.html

        It really depends on how the additional addresses are provisioned to you and what you are trying to do with them.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        S 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          You didn't hide the IP very will in your ping ;) You forgot the bottom part where it shows the stats of what IP you were pinging.

          But why are you 1:1 natting to public IPs? Looks like your dest in your 1:1 nat is 128.x address?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          S 1 Reply Last reply Reply Quote 0
          • S
            Su30MKI @Derelict
            last edited by

            @derelict Hello Derelict, Thank you for the reply. There are 15 usable static IPs from the ISP. I have configured one as VIP and trying to NAT it to the DMZ server.

            DerelictD 1 Reply Last reply Reply Quote 0
            • S
              Su30MKI @johnpoz
              last edited by

              @johnpoz Hello John, If not NATed from the the public-ip-->DMZ server, How the DMZ server will be accessible globally?

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate @Su30MKI
                last edited by

                @su30mki said in 1:1 NAT not working. Replacing Checkpoint with Pfsense:

                @derelict Hello Derelict, Thank you for the reply. There are 15 usable static IPs from the ISP. I have configured one as VIP and trying to NAT it to the DMZ server.

                Are they on the interface network or are they routed to you?
                What is the subnet mask they told you to use?
                What are the last octets of the addresses they said you could use?
                What is the last octet of the gateway they said to use?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                S 1 Reply Last reply Reply Quote 0
                • S
                  Su30MKI @Derelict
                  last edited by

                  @derelict The ISP connection comes to a cisco router and from there the 15 IPs are released. The network subnet is 28, The subnet mask is 255.255.255.240. All the usable IPs belong to the same subnet no change. All the usable IPs worked well for NAT with the old checkpoint firewall.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    OK so you want to 1:1 NAT from one of those to another address on a different subnet on the inside. Those are usually RFC1918 addresses, like 192.168.1.100.

                    https://www.netgate.com/docs/pfsense/book/nat/1-1-nat.html

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Su30MKI
                      last edited by

                      @Derelict The DMZ network is 128.50.0.0/16. Should I change it to class C IP address for the NAt to work?

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        No, it doesn't matter, but those are not private addresses, they are assigned to the United States Department of Defense.

                        https://en.wikipedia.org/wiki/Private_network

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Why in the world would of used 128.50?? Clearly those are NOT yours... And a /16 - so 65k some hosts?

                          Just at a loss here. Yes you should fix it - you should use rfc1918 space - what its designed for.. And you should use an appropriate sized network.. If for no other reason you don't look like an idiot next time you have a question and post up your details..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            Su30MKI @johnpoz
                            last edited by

                            @johnpoz It is still in my private network. How is that going to affect the NAT?

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              It is not private address space.. Its owned by the DOD..

                              NetRange: 128.50.0.0 - 128.50.255.255
                              CIDR: 128.50.0.0/16
                              Organization: Department of Defense (DEPART)

                              Sure you can technically use it - as long as you don't want any of those devices to talk to or get talked to by that network.. It just clearly points out to anyone that learns it that you don't understand even basic principles..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              S 1 Reply Last reply Reply Quote 1
                              • S
                                Su30MKI @johnpoz
                                last edited by

                                @johnpoz Thank you for the reply. I will change it.

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Su30MKI
                                  last edited by Su30MKI

                                  Hello,

                                  I got a break through. I changed the DMZ IP to 10.50.20.0/25. I NATted it to the DMZ server, Now I get connection refused error and not connection timed out error. I think the firewall is not letting the connection through.1_1535624624109_WAN-Rules.PNG 0_1535624624011_NAT-DMZ.PNG

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    Why are you hiding your 10.50 address? /25 - so you go from a /16 to a /25... Ok Sure you didn't mess up something in the mask?

                                    Firewall would not send a RST or anything if it was blocking it.. Unless you setup a specific REJECT rule.. So sounds more like your end box at 10.50.x.x you know that super secret rfc1918 address that nobody can know ;)

                                    Simple sniff shows you if pfsense sends on the traffic to end device.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Su30MKI
                                      last edited by Su30MKI

                                      Alright, As you see the public ip is NATed to the DMZ server. Public IP : 125.21.XX.XX DMZ server IP : 10.50.20.3.
                                      NAT 1:1 Mapping

                                      Interface : WAN
                                      External IP : 125.21.xx.xx
                                      Internal IP : 10.50.20.3

                                      WAN Rules

                                      Protocol : IPV4
                                      Source : 125.21.xx.xx
                                      port : Any
                                      Destination : Any.

                                      Now the error is connection refused, Earlier it was connection timed out.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        You are never going to have traffic into WAN sourced from an IP address on the WAN interface. The firewall rule should be sourced (presumably) from any which is any host on the internet.

                                        The destination address should be the post-NAT real address of the destination server, or 10.50.masked.masked.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          You can for sure limit the source to your actual source out on the internet to get to this host your sending the nat too.. But if your putting in your actual wan IP, then as Derelict has stated - that is never going to work.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.