Using PfSense to serve CGNAT or Dual Stack Lite

0daymaster

Hi. I am launching a WISP as we speak and I only have a limited IPv4 block from my upstream service provider. I'm looking to put my CPE gateways behind a CGNAT and using pfSense as a combined edge router, firewall and NAT box. Running CGNAT should be as simple as assigned a 100.64.0.0/10 subnet to an interface. My question is how to implement RFC7422 (fixed port ranges for each customer device). Or is there any way to implement Dual Stack Lite on pfSense? Thanks.

johnpoz

@0daymaster said in Using PfSense to serve CGNAT or Dual Stack Lite:

RFC7422

Very important info from that rfc.
"The RFC Editor has chosen to publish this document at its discretion and makes no statement about its value for implementation or deployment."

So are you are wanting to do this for the logging aspects of this? I don't see how this helps you to be honest, since you would need more IPs and Ports when customer exceeds their sessions that you have broken out to them.

There is no such capability that I am aware of it pfsense or freebsd that could do this without large amount of manual setup.

You could manually create the outbound nats to only use specific ports for translation, and setup them to use a specific VIP/Interface on the public side.

But not sure what happens when say you give 5000 ports to customer X and they need 5001+

0daymaster

Thanks. Yes, I want to implement this for legal reasons. By assigning ranges of ports to CPE devices I would not have to run DPI in order to track outbound connections. I will ask our upstream service provider for best practices on running CGNAT as they were the ones who suggested it.

0daymaster

@johnpoz According to Juniper 1024 ports is a liberal assignment for 250+ NAT sessions. From my experience as an MSP most customers will never exceed 1500 NAT sessions (unless they torrent) so ~5000 ports is actually a pretty good number.

johnpoz

So your customer is a single family home.. Not a business with 50 users?

0daymaster

@johnpoz Mostly small businesses.

0daymaster

My immediate goal in regards to addressing is to make it long enough so that I can purchase a class C IPv4 netblock on the open market. Nothing would make me happier than the death of IPv4 but until then I am forced to support it.