I think VIP and internal servers
-
Good day,
Actually, i'm running with a Fortigate and migrating to a XG-7100
At another site I have a SG-2200 and I'm able to do port forwarding without any issue.
Here is a topo:
I have 2x /28 (xxx.113.10.96/28 (my main one) and xxx.253.240.240/28 (which is route to my other /28)
My WAN ip is xxx.113.10.98/28.
I have differents ip that serve for different service..
xxx.113.10.101 - > 192.168.4.37 - Port 443
xxx.113.10.104 -> 192.168.4.13 - Port 25
xxx.253.240.241 -> 192.168.30.10 - Port 80 and 443External IP get to an internal server ip with a specfic port.
So, how can I do that. I'm totally lost.
Thanks a lot!
edit: added a port to an IP
-
Just add the IPs from the second subnet in as VIPs (I'd use CARP type) and create the port-forwards.
Edit- to clarify, add them just like you would add the ones on your WAN- the 101 and the 104. -
I dont seem to be able to use carp.. I only have one device. no HA
Is it more 1:1 nat ?
-
You don't need a VIP for the routed subnet addresses. All you do is make a port forward.
If you WANT to make a VIP for the addresses you can make an Other type VIP that serves as a menu item when you are doing things like creating port forwards but really does nothing. A port forward will work with or without an Other type VIP.
You do need some sort of VIP for the interface subnet addresses because they need to respond to ARP. I would use IP Alias in that case, not CARP. (You don't need to be running HA to use CARP VIPs, but I would say that if you're not running HA IP Alias is the better choice, generally.
https://docs.netgate.com/pfsense/en/latest/book/nat/port-forwards.html
https://www.netgate.com/docs/pfsense/nat/forwarding-ports-with-pfsense.html
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html
-
Thanks Derelict. Based on what you suggested me i found it !
And.. another quicky... from specific machine internally, i want them to use a specific IP when accessing the net..
like users get with a .110 ip
my mail server use .104 ip.. ? -
Set your Outbound NAT how you want for specific sources.
https://docs.netgate.com/pfsense/en/latest/book/nat/outbound-nat.html
-
Again.. thanks a lot..
just to be sure... in the source.. it say network.. but I can add one internal ip (like 192.168.4.13/32) rather than a network?
-
Yes, for a single source host use /32
-
Thanks a lot!
you cant imagine the help you just gave me! :)
Frank