Outbound NAT is not enforced for the FW
-
Hi,
The Outbound NAT is not enforcing for the FW, instead of having my public @ip, I have 0.0.0.0.
My test is to do since my pfsense 2.4.4-RELEASE-p2 an nslookup :
[2.4.4-RELEASE][admin@pf-msclab1.msc.lab]/root: nslookup > server 8.8.8.8 Default server: 8.8.8.8 Address: 8.8.8.8#53 > yahoo.fr ;; connection timed out; no servers could be reached > yahoo.fr ;; connection timed out; no servers could be reachedthe source address is 0.0.0.0 instead of 212.129.XX.XX :
[2.4.4-RELEASE][root@pf-msclab1.msc.lab]/root: tcpdump -nni vmx0 host 8.8.8.8 and not icmp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on vmx0, link-type EN10MB (Ethernet), capture size 262144 bytes 13:49:04.349084 IP 0.0.0.0.64958 > 8.8.8.8.53: 3921+ A? yahoo.fr. (26) 13:49:11.874178 IP 0.0.0.0.33334 > 8.8.8.8.53: 9973+ A? yahoo.fr. (26) 13:49:16.962297 IP 0.0.0.0.33334 > 8.8.8.8.53: 9973+ A? yahoo.fr. (26)Here is my Nat table :
[2.4.4-RELEASE][admin@pf-msclab1.msc.lab]/root: grep tonatsubnets /tmp/rules.debug table <tonatsubnets> { 127.0.0.0/8 ::1/128 172.31.10.0/24 10.89.255.13/32 10.90.254.100/32 10.60.10.0/24 10.60.3.0/24 10.60.1.0/24 10.60.2.0/24 10.60.5.0/24 10.60.4.0/24 10.60.6.0/24 10.88.114.32/28 10.200.140.0/24 10.8.222.2 } nat on $WAN inet from <tonatsubnets> to any port 500 -> 212.129.XX.XX/32 static-port nat on $WAN inet6 from <tonatsubnets> to any port 500 -> 2001:xxx:xxxx:100::1/128 static-port nat on $WAN inet from <tonatsubnets> to any -> 212.129.XX.XX/32 port 1024:65535 nat on $WAN inet6 from <tonatsubnets> to any -> 2001:xxx:xxxx:100::1/128 port 1024:65535 [2.4.4-RELEASE][admin@pf-msclab1.msc.lab]/root: pfctl -sa | grep ^nat nat-anchor "natearly/*" all nat-anchor "natrules/*" all nat on vmx9.2003 inet from any to 10.60.3.65 -> 10.60.3.254 port 1024:65535 nat on vmx9.2004 inet from any to 10.60.1.96 -> 10.60.1.254 port 1024:65535 nat on vmx9.2004 inet from any to 10.60.1.42 -> 10.60.1.254 port 1024:65535 nat on vmx9.2004 inet from any to 10.60.1.107 -> 10.60.1.254 port 1024:65535 nat on vmx9.2004 inet from any to 10.60.1.121 -> 10.60.1.254 port 1024:65535 nat on vmx9.2003 inet from any to 10.60.3.96 -> 10.60.3.254 port 1024:65535 nat on vmx9.2003 inet from any to 10.60.3.30 -> 10.60.3.254 port 1024:65535 nat on vmx9.2002 inet from 10.60.1.0/24 to 10.90.254.100 -> 10.88.114.34 port 1024:65535 nat on vmx9.2002 inet from 10.60.1.0/24 to 10.89.255.13 -> 10.88.114.34 port 1024:65535 nat on vmx0 inet from <tonatsubnets> to any port = isakmp -> 212.129.XX.XX static-port nat on vmx0 inet6 from <tonatsubnets> to any port = isakmp -> 2001:xxx:xxxx:100::1 static-port nat on vmx0 inet from <tonatsubnets> to any -> 212.129.XX.XX port 1024:65535 nat on vmx0 inet6 from <tonatsubnets> to any -> 2001:xxx:xxxx:100::1 port 1024:65535 [2.4.4-RELEASE][admin@pf-msclab1.msc.lab]/root: pfctl -t tonatsubnets -T show 10.8.222.2 10.60.1.0/24 10.60.2.0/24 10.60.3.0/24 10.60.4.0/24 10.60.5.0/24 10.60.6.0/24 10.60.10.0/24 10.88.114.32/28 10.89.255.13 10.90.254.100 10.200.140.0/24 127.0.0.0/8 172.31.10.0/24 ::1 [2.4.4-RELEASE][admin@pf-msclab1.msc.lab]/root: ifconfig vmx0 vmx0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:50:56:01:78:9a hwaddr 00:50:56:01:78:9a inet6 fe80::250:56ff:fe01:789a%vmx0 prefixlen 64 scopeid 0x1 inet6 2001:xxx:xxxx:100::1 prefixlen 128 inet 212.129.xx.xx netmask 0xffffffff broadcast 212.129.xx.xx nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> media: Ethernet autoselect status: active [2.4.4-RELEASE][admin@pf-msclab1.msc.lab]/root: netstat -nr4 Routing tables Internet: Destination Gateway Flags Netif Expire default 62.210.0.1 UGS vmx0 9.9.9.9 62.210.0.1 UGHS vmx0 10.8.222.1 link#23 UHS lo0 10.8.222.2 link#23 UH ipsec300 10.60.1.0/24 link#20 U vmx9.200 10.60.1.254 link#20 UHS lo0 10.60.2.0/24 link#19 U vmx9.200 10.60.2.254 link#19 UHS lo0 10.60.3.0/24 link#21 U vmx9.200 10.60.3.254 link#21 UHS lo0 10.60.4.0/24 link#18 U vmx9.200 10.60.4.254 link#18 UHS lo0 10.60.5.0/24 link#16 U vmx9.200 10.60.5.254 link#16 UHS lo0 10.60.6.0/24 link#17 U vmx9.200 10.60.6.254 link#17 UHS lo0 10.60.10.0/24 link#22 U vmx9.201 10.60.10.254 link#22 UHS lo0 10.88.114.32/28 link#15 U vmx9.200 10.88.114.34 link#15 UHS lo0 10.89.255.13/32 10.88.114.33 UGS vmx9.200 10.90.254.100/32 10.88.114.33 UGS vmx9.200 10.200.140.0/24 link#2 U vmx1 10.200.140.1 link#2 UHS lo0 37.71.xx.xx 62.210.0.1 UGHS vmx0 37.71.xx.xx 62.210.0.1 UGHS vmx0 62.210.xx.xx 00:50:56:01:78:9a UHS vmx0 62.210.xx.xx 62.210.0.1 UGHS vmx0 86.194.xx.xx 62.210.0.1 UGHS vmx0 91.243.xx.xx 62.210.0.1 UGHS vmx0 91.243.xx.xx 62.210.0.1 UGHS vmx0 127.0.0.1 link#12 UH lo0 149.112.xx.xx 62.210.0.1 UGHS vmx0 172.31.10.0/24 10.8.222.2 UGS ipsec300 212.129.xx.xx 62.210.0.1 UGHS vmx0 212.129.xx.xx link#1 UHS lo0 212.129.xx.xx/32 link#1 U vmx0Thanks for the help
fred
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.