Adding large number of NAT policy without disturbing the existing NAT conf.

[jimp]

@thoufiq said in Adding large number of NAT policy without disturbing the existing NAT conf.:

have to add additional 500 aliases and respective NAT policies

Are you sure you do? That sounds like a problem that could be greatly simplified in some way by using smarter policies instead of so many entries. Either using subnets or IP ranges or something simpler than a ton of aliases/NAT rules.

Can you give more detail about the problem you are trying to solve?

[johnpoz]

With Jim on this.. 500 nats seems a bit nuts.. Could not just use a 1:1 policy for the whole subnet? Or just put the native network on the devices and just firewall vs natting in the first place?

More info would help us determine if using the best method to skin this particular cat.

[Thoufiq]

@johnpoz

Requirements:
Need to NAT- 5 Private IPs to a public IP. As of 500 NAT has been created. Need to do more NATs according to the future requirements.
Particular private IPs should be mapped(NAT) for particular Public IP
Traffic is from private to public
No incoming traffic should be allowed

Actions:

Bringup a pfsense clusters with basic configuration (HA-CARP-Cluster)

We have created Aliases for Private IPs and Public IPs
Eg-Aliases
Private-1-10.0.0.1,10.0.0.2,10.0.0.3,10.0.0.4,10.0.0.5
Public-1-x.x.x.1

NAT the Private IPs to its respective public IPs
Eg-NAT
Outbound----WAN----Private-1-----Sourceport/*---- Dest port------Public-1----

[Thoufiq]

This post is deleted!

[johnpoz]

So you have 5 rfc1918 boxes that you want to use public IP1, then a different 5 IPs want to use publicIP2, and then different 5 use publicIP3..

And all of these private IPs are on the same rfc1918 netblock?

That is what your trying to do..

Why exactly? Why can you not just address pools for your outbound nat? This would make your configuration way simpler..

[Thoufiq]

@johnpoz Yes exactly we have a server that has 100 virtual IPs(private) assigned in it.Similarly we have 20 servers.

like u said,each 5 virtual IPs to be mapped to a public IP

And all of these private IPs are on the same rfc1918 netblock?- /16 private subnet

Why can you not just address pools for your outbound nat?- that is what we suggested, but the application team's requirement is to map a particular public IP to a particular private IP... The application team will give particular public IP details to the clients to get the service...

[Thoufiq]

@thoufiq Will pfsense handle 64K nats and 10million sessions?

[johnpoz]

Will it handle that? How big is the box? 10 million sessions is quite a few... How big is this pfsense box your running?

The application team will give particular public IP details to the clients to get the service...

Thought you said there was no inbound traffic? Or maybe that was someone elses thread?

[Thoufiq]

@johnpoz No incoming traffic.. we have given Particular IPs to Clients for not blocking it at any cause and the application send continuous traffic ?

[Thoufiq]

@thoufiq
Server specification?
Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
Current: 2400 MHz, Max: 2401 MHz
20 CPUs: 2 package(s) x 10 core(s)
AES-NI CPU Crypto: Yes (inactive)

[Thoufiq]

@thoufiq What do we have to do to increase the pfsense's state...

[johnpoz]

You can edit the max number of states under Advanced, Firewall and Nat..

To what that system could actually do, there are other people here that might be able to help you with that.. But seems pretty beefy ;) How much ram? What nics do you have in it? What sort of wan connection - just curious..

But pretty sure in the 1:1 nat you can do a hash so you always use the same IP for that source, etc.

https://www.netgate.com/docs/pfsense/nat/outbound-nat.html
Source Hash
Uses a hash of the source address to determine the translation address, ensuring that the redirection address is always the same for a given source.

You could then give the customer that IP... Which would solve your problem without so many specific rules I would think.. If they are using the rules on their side to allow the traffic - could you not just give them the cidr address for your address block

[Thoufiq]

@johnpoz If we create 1:1 NAT then we have to create IPalias(VIP) for each public IP ryt?