Adding large number of NAT policy without disturbing the existing NAT conf.

[Thoufiq]

Hi,
My early post
"
Import large number of Aliases/NAT to pfsense
I need to NAT 4 internal IPs to a public IP. So i decided to create alias for the internal IPs and public IP and do Outbound NAT. It is working... But i need to do the same for 500 hosts is there any way to import the Aliases/ NAT pfsesnse(From excel or notepad) or any other way to simplify this task!!!Please help....."

@johnpoz suggested***"Just grab the alias and nat sections. Edit them to your liking and then restore.. There are plenty of places that will parse a text file or csv, etc. and put it into xml format for you with all the labels needed sort of thing.***"

I did the same and it really reduces the time and it is working fine and now the problem is that i have to add additional 500 aliases and respective NAT policies. For that i need to download NAT & aliases config and need to edit and upload it again.. but it requires some downtime... Is there any other way to do this without download/ restore the config.....

Please help....

[johnpoz]

why would download and upload require downtime?

[Thoufiq]

When we upload the configuration, It is giving us warning that it may require reboot. So we need to instruct the production team for downtime. if we can load the additional configuration without editing the existing dowloaded config file,it will also reduce the config error...

[Thoufiq]

What is saltstack.. Can we handle this kind of requirements using saltstack? Please help..

[Thoufiq]

I have a pfsense cluster in testing phase...i just uploaded the new NAT config... it gave me warning "may need a reboot" i didnt reboot it but it accepts the configuration. Does this restore operation require reboot ?

[johnpoz]

Do your nats work? Sorry I have never needed to restore an outbound nat config.. Firewall rules only require a reload of the filter, so I would think nat should be the same... Since they are just rules as well.

Hit the save button on your nat page. If you show the nats, and you hit save they should work... Just like when you create a new nat.. Did you have to reboot then - NO..

But yes the restore of some config items could require a reboot.. Firewall rules and or Nats should not.. But its very difficult for the system to know exactly was changed when you restore - so sure it makes sense to tell you "may" need a reboot..

[Thoufiq]

@johnpoz The servers level configurations are going on.. Once completed we will test this setup..

Thanks for the clarification...
Will let you know once done...

[jimp]

@thoufiq said in Adding large number of NAT policy without disturbing the existing NAT conf.:

have to add additional 500 aliases and respective NAT policies

Are you sure you do? That sounds like a problem that could be greatly simplified in some way by using smarter policies instead of so many entries. Either using subnets or IP ranges or something simpler than a ton of aliases/NAT rules.

Can you give more detail about the problem you are trying to solve?

[johnpoz]

With Jim on this.. 500 nats seems a bit nuts.. Could not just use a 1:1 policy for the whole subnet? Or just put the native network on the devices and just firewall vs natting in the first place?

More info would help us determine if using the best method to skin this particular cat.

[Thoufiq]

@johnpoz

Requirements:
Need to NAT- 5 Private IPs to a public IP. As of 500 NAT has been created. Need to do more NATs according to the future requirements.
Particular private IPs should be mapped(NAT) for particular Public IP
Traffic is from private to public
No incoming traffic should be allowed

Actions:

Bringup a pfsense clusters with basic configuration (HA-CARP-Cluster)

We have created Aliases for Private IPs and Public IPs
Eg-Aliases
Private-1-10.0.0.1,10.0.0.2,10.0.0.3,10.0.0.4,10.0.0.5
Public-1-x.x.x.1

NAT the Private IPs to its respective public IPs
Eg-NAT
Outbound----WAN----Private-1-----Sourceport/*---- Dest port------Public-1----

[Thoufiq]

This post is deleted!

[johnpoz]

So you have 5 rfc1918 boxes that you want to use public IP1, then a different 5 IPs want to use publicIP2, and then different 5 use publicIP3..

And all of these private IPs are on the same rfc1918 netblock?

That is what your trying to do..

Why exactly? Why can you not just address pools for your outbound nat? This would make your configuration way simpler..

[Thoufiq]

@johnpoz Yes exactly we have a server that has 100 virtual IPs(private) assigned in it.Similarly we have 20 servers.

like u said,each 5 virtual IPs to be mapped to a public IP

And all of these private IPs are on the same rfc1918 netblock?- /16 private subnet

Why can you not just address pools for your outbound nat?- that is what we suggested, but the application team's requirement is to map a particular public IP to a particular private IP... The application team will give particular public IP details to the clients to get the service...

[Thoufiq]

@thoufiq Will pfsense handle 64K nats and 10million sessions?

[johnpoz]

Will it handle that? How big is the box? 10 million sessions is quite a few... How big is this pfsense box your running?

The application team will give particular public IP details to the clients to get the service...

Thought you said there was no inbound traffic? Or maybe that was someone elses thread?

[Thoufiq]

@johnpoz No incoming traffic.. we have given Particular IPs to Clients for not blocking it at any cause and the application send continuous traffic ?

[Thoufiq]

@thoufiq
Server specification?
Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
Current: 2400 MHz, Max: 2401 MHz
20 CPUs: 2 package(s) x 10 core(s)
AES-NI CPU Crypto: Yes (inactive)

[Thoufiq]

@thoufiq What do we have to do to increase the pfsense's state...

[johnpoz]

You can edit the max number of states under Advanced, Firewall and Nat..

To what that system could actually do, there are other people here that might be able to help you with that.. But seems pretty beefy ;) How much ram? What nics do you have in it? What sort of wan connection - just curious..

But pretty sure in the 1:1 nat you can do a hash so you always use the same IP for that source, etc.

https://www.netgate.com/docs/pfsense/nat/outbound-nat.html
Source Hash
Uses a hash of the source address to determine the translation address, ensuring that the redirection address is always the same for a given source.

You could then give the customer that IP... Which would solve your problem without so many specific rules I would think.. If they are using the rules on their side to allow the traffic - could you not just give them the cidr address for your address block

[Thoufiq]

@johnpoz If we create 1:1 NAT then we have to create IPalias(VIP) for each public IP ryt?