• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Adding large number of NAT policy without disturbing the existing NAT conf.

Scheduled Pinned Locked Moved NAT
20 Posts 3 Posters 1.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • T
    Thoufiq @johnpoz
    last edited by Jan 8, 2019, 2:45 PM

    This post is deleted!
    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz Jan 8, 2019, 5:22 PM Jan 8, 2019, 5:18 PM

      So you have 5 rfc1918 boxes that you want to use public IP1, then a different 5 IPs want to use publicIP2, and then different 5 use publicIP3..

      And all of these private IPs are on the same rfc1918 netblock?

      That is what your trying to do..

      Why exactly? Why can you not just address pools for your outbound nat? This would make your configuration way simpler..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      T 1 Reply Last reply Jan 9, 2019, 11:58 AM Reply Quote 0
      • T
        Thoufiq @johnpoz
        last edited by Jan 9, 2019, 11:58 AM

        @johnpoz Yes exactly we have a server that has 100 virtual IPs(private) assigned in it.Similarly we have 20 servers.

        like u said,each 5 virtual IPs to be mapped to a public IP

        And all of these private IPs are on the same rfc1918 netblock?- /16 private subnet

        Why can you not just address pools for your outbound nat?- that is what we suggested, but the application team's requirement is to map a particular public IP to a particular private IP... The application team will give particular public IP details to the clients to get the service...

        T 1 Reply Last reply Jan 9, 2019, 12:01 PM Reply Quote 0
        • T
          Thoufiq @Thoufiq
          last edited by Jan 9, 2019, 12:01 PM

          @thoufiq Will pfsense handle 64K nats and 10million sessions?

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz Jan 9, 2019, 12:09 PM Jan 9, 2019, 12:07 PM

            Will it handle that? How big is the box? 10 million sessions is quite a few... How big is this pfsense box your running?

            The application team will give particular public IP details to the clients to get the service...

            Thought you said there was no inbound traffic? Or maybe that was someone elses thread?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            T 1 Reply Last reply Jan 9, 2019, 1:05 PM Reply Quote 0
            • T
              Thoufiq @johnpoz
              last edited by Jan 9, 2019, 1:05 PM

              @johnpoz No incoming traffic.. we have given Particular IPs to Clients for not blocking it at any cause and the application send continuous traffic ?

              T 1 Reply Last reply Jan 9, 2019, 1:11 PM Reply Quote 0
              • T
                Thoufiq @Thoufiq
                last edited by Jan 9, 2019, 1:11 PM

                @thoufiq
                Server specification?
                Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
                Current: 2400 MHz, Max: 2401 MHz
                20 CPUs: 2 package(s) x 10 core(s)
                AES-NI CPU Crypto: Yes (inactive)

                T 1 Reply Last reply Jan 9, 2019, 2:02 PM Reply Quote 0
                • T
                  Thoufiq @Thoufiq
                  last edited by Jan 9, 2019, 2:02 PM

                  @thoufiq What do we have to do to increase the pfsense's state...

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz Jan 9, 2019, 2:44 PM Jan 9, 2019, 2:41 PM

                    You can edit the max number of states under Advanced, Firewall and Nat..

                    To what that system could actually do, there are other people here that might be able to help you with that.. But seems pretty beefy ;) How much ram? What nics do you have in it? What sort of wan connection - just curious..

                    But pretty sure in the 1:1 nat you can do a hash so you always use the same IP for that source, etc.

                    https://www.netgate.com/docs/pfsense/nat/outbound-nat.html
                    Source Hash
                    Uses a hash of the source address to determine the translation address, ensuring that the redirection address is always the same for a given source.

                    You could then give the customer that IP... Which would solve your problem without so many specific rules I would think.. If they are using the rules on their side to allow the traffic - could you not just give them the cidr address for your address block

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    T 1 Reply Last reply Jan 10, 2019, 6:13 AM Reply Quote 0
                    • T
                      Thoufiq @johnpoz
                      last edited by Jan 10, 2019, 6:13 AM

                      @johnpoz If we create 1:1 NAT then we have to create IPalias(VIP) for each public IP ryt?

                      1 Reply Last reply Reply Quote 0
                      20 out of 20
                      • First post
                        20/20
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received