Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I Broke NAT... on my Multi Site Lab.

    Scheduled Pinned Locked Moved NAT
    2 Posts 1 Posters 250 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      steve1399
      last edited by

      I have 2 physical ESXi servers that I run as Site1 and Site2 (Both have an interface on my corp network), both physical hosts run a VMware Nested Environment. I recently moved those nested environments behind a virtualized PFsense appliances on each side. Initially I was okay with everything being NAT'd and that worked great. Now I have to add a couple additional networks that must be routed between the sites. I'll detail how I configured it. It seemed to work as I can now route between these networks but it broke NAT outbound and I'm at al loss as to how I've misconfigured it.

      This screencap shows my networks, WAN is corp, LAN is connected to a cumulus Spine/Leaf network that allows my nested SDDC traffic to route out to the WAN, OPT1 is for Management of all of the nested components, EXT was just another network I was adding to add an additional routed network to the other site.

      Screen Shot 2020-03-18 at 2.22.54 PM.png

      PFsense can ping all of the gateways I'm trying to get to.

      Screen Shot 2020-03-18 at 2.22.29 PM.png

      Here's what I have configured in the UI.

      Gateways:
      Screen Shot 2020-03-18 at 2.11.52 PM.png
      Static Routes:
      Screen Shot 2020-03-18 at 2.12.10 PM.png

      Finally, this is how I have NAT configured. I created 2 rules to not NAT for the two destinations on the second site.

      Screen Shot 2020-03-18 at 2.10.01 PM.png
      I'm not sure why, but this just breaks NAT all together. All of the hosts with interfaces on Management 192.168.1.x can ping the second site, they can even ping the second sites corp address 10.33.72.66, but they can't NAT out to anything else.

      Any help from the community would be greatly appreciated.

      1 Reply Last reply Reply Quote 0
      • S
        steve1399
        last edited by

        Trying Manual Outbound NAT also. I found that rules weren't created so I found out that I didn't have a gateway set, once set the rules populated.

        Screen Shot 2020-03-20 at 8.19.05 AM.png

        So now I'm back and can ping out to the WAN gateway but The rule that should disable NAT for source 192.168.1.0 dest 192.168.2.0 doesn't do anything even if I put it on top.

        Screen Shot 2020-03-20 at 8.23.40 AM.png

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.