Adding large number of NAT policy without disturbing the existing NAT conf.
-
This post is deleted! -
So you have 5 rfc1918 boxes that you want to use public IP1, then a different 5 IPs want to use publicIP2, and then different 5 use publicIP3..
And all of these private IPs are on the same rfc1918 netblock?
That is what your trying to do..
Why exactly? Why can you not just address pools for your outbound nat? This would make your configuration way simpler..
-
@johnpoz Yes exactly we have a server that has 100 virtual IPs(private) assigned in it.Similarly we have 20 servers.
like u said,each 5 virtual IPs to be mapped to a public IP
And all of these private IPs are on the same rfc1918 netblock?- /16 private subnet
Why can you not just address pools for your outbound nat?- that is what we suggested, but the application team's requirement is to map a particular public IP to a particular private IP... The application team will give particular public IP details to the clients to get the service...
-
@thoufiq Will pfsense handle 64K nats and 10million sessions?
-
Will it handle that? How big is the box? 10 million sessions is quite a few... How big is this pfsense box your running?
The application team will give particular public IP details to the clients to get the service...
Thought you said there was no inbound traffic? Or maybe that was someone elses thread?
-
@johnpoz No incoming traffic.. we have given Particular IPs to Clients for not blocking it at any cause and the application send continuous traffic ?
-
@thoufiq
Server specification?
Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
Current: 2400 MHz, Max: 2401 MHz
20 CPUs: 2 package(s) x 10 core(s)
AES-NI CPU Crypto: Yes (inactive) -
@thoufiq What do we have to do to increase the pfsense's state...
-
You can edit the max number of states under Advanced, Firewall and Nat..
To what that system could actually do, there are other people here that might be able to help you with that.. But seems pretty beefy ;) How much ram? What nics do you have in it? What sort of wan connection - just curious..
But pretty sure in the 1:1 nat you can do a hash so you always use the same IP for that source, etc.
https://www.netgate.com/docs/pfsense/nat/outbound-nat.html
Source Hash
Uses a hash of the source address to determine the translation address, ensuring that the redirection address is always the same for a given source.You could then give the customer that IP... Which would solve your problem without so many specific rules I would think.. If they are using the rules on their side to allow the traffic - could you not just give them the cidr address for your address block
-
@johnpoz If we create 1:1 NAT then we have to create IPalias(VIP) for each public IP ryt?