Firewall blocks traffic coming from Linux NAT
-
My pfSense firewall has WAN/LAN/DMZ_INT/DMZ_EXT interfaces. The DMZ interfaces are vlans and they host internal or external services. By default all traffic coming to the DMZ interfaces is blocked.
I want to allow access to a service in DMZ_INT from another vlan (10.1.100.0/24). The 10.1.100.0 vlan is not configured on pfSense. The traffic comes from a server from the LAN interface which also has the vlan 10.1.100.0 configured as a separate interface. The server is running Linux and is configured with iptables NAT.
pfSense will block all traffic coming from the 10.1.100.0 hosts even though the firewall is configured to allow this traffic. In the firewall logs I can see the blocked packet and it seems that pfSense attempts to reply using the 10.1.100.0 IP address instead of the Linux NAT server address.
Basically, the traffic flows as follows:
|Client - 10.1.100.31| ---> |Linux NAT 10.1.100.1 - 10.2.251.28| ---> |pfSense 10.2.251.254 - 10.3.30.254| -> |Server - 10.3.30.50|
LAN clients can access this server. Also clients from the 10.1.100.0 vlan can access other services in LAN through NAT.
I believe this is FreeBSD related but I can't seem to find an answer online. My opinion is the traffic from the client should get back on the Linux NAT address not on the source IP of the client, which pfSense can't access directly.
Can someone please help me find out the answer to this and if there's a way to solve it?
Many thanks!