Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    First configuration : NAT

    Scheduled Pinned Locked Moved NAT
    42 Posts 3 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Freyja
      last edited by

      @freyja said in First configuration : NAT:

      I want to mask my internal network.

      What? Mask it from who? Yourself?

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      F 1 Reply Last reply Reply Quote 0
      • F
        Freyja @johnpoz
        last edited by

        @johnpoz no, from anyone that would be able to connect to my server in DMZ and able to successfully exploit a vulnerability.

        Should I really need to explain why I want to do that?
        The simple answer is : I was doing this with my Pix and all my configuration is based on that.

        I want to reproduce this behavior.

        Isn't it possible with pfSense?
        Does it have any drawbacks?

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Freyja
          last edited by johnpoz

          @freyja said in First configuration : NAT:

          from anyone that would be able to connect to my server in DMZ and able to successfully exploit a vulnerability.

          You understand if your calling it a dmz.. it wouldn't be able to even connect to your lan - no matter if they know the IP or not..

          While you can allow connections from your lan to your "dmz" vlan - just set your rules so that anything in the dmz can not start a conversation with anything in your lan.

          Or just allow specific that you might need, for example some of my restricted vlans.. like my roku vlan can talk to my plex on port 32400.. But they need to know what that IP is, etc.. Be it hidden or not wouldn't matter.. If say they exploited some box and know that it was talking to plex be it IP looking like it was 10.1.10.x or 10.1.12.x etc.. The traffic is either allowed or not - masking what the IP is does nothing.

          Example - here is a limited vlan example. devices in this vlan can ping pfsense IP in that vlan, dns and ntp. But everything else is not possible.

          locked.png

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          F 1 Reply Last reply Reply Quote 0
          • F
            Freyja @johnpoz
            last edited by Freyja

            @johnpoz I understand all of that... I shouldn't have to say it but I work in computer security for more than twenty years, so yeah I know all of that.

            This is not my question, I would like to know if it's possible to do it or not?

            Because I don't want to have to reconfigure anything and my reasons to obfuscate my lan stand because I don't like simplify the job for hackers. But really, why should I have to justify myself on something rather standard?

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Freyja
              last edited by johnpoz

              Sure you can nat to anything you want - you would just have to set it up... Just POINTLESS..

              Not asking you to justify anything - just trying to understand why anyone would do such a thing.. Does nothing but over complex something that serves no purpose. And provides no extra anything from a security standpoint.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              F 1 Reply Last reply Reply Quote 0
              • F
                Freyja @johnpoz
                last edited by

                @johnpoz please stop because it's going nowhere.

                That's your opinion, not mine.
                Simply the fact that I would not have to reconfigure everything should be enough for you.

                I just want to know how to do it. If you don't want to help, fine, but please stop with what you are doing

                KOMK 1 Reply Last reply Reply Quote 0
                • KOMK
                  KOM @Freyja
                  last edited by KOM

                  @freyja I can't get it working either after playing with it for a few minutes. I wonder if this is another manifestation of the multi-wan NAT bug?

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @KOM
                    last edited by johnpoz

                    For this to work - the IPs that would be natted would have to exist on pfsense interface - so @KOM you setup vips in this 10.1.10 network on pfsense?

                    If you have a network 10.1.10 as lan, and 10.1.12 as dmz

                    And you want to hit 10.1.10.X and get natted 1:1 to dmz that .X would have to be an IP on pfsense lan interface. Or why would the traffic ever get sent to pfsense to get natted and sent to its 1:1 match up in 10.1.12

                    Here - I setup a vip on my lan 192.168.9.32, setup a 1:1 nat to 192.168.3.32 (my dmz vlan)

                    Now I ping 192.168.9.32 from client on my lan 192.168.9.100, it gets answers. And via the sniff done on pfsense dmz interface you can see the traffic was sent and answered by 192.168.3.32

                    nat.png

                    Now if this has something to do with the multi wan nat issue - but seems to be working as expected on 21.02.2

                    This sort of setup just doesn't make any sense from any way you look at.. Be it you hide the actual IP from lan or not - the access is still there..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    KOMK 1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM @johnpoz
                      last edited by

                      @johnpoz Sure did. When I couldn't get it going, I double-checked the docs at

                      https://docs.netgate.com/pfsense/en/latest/nat/1-1.html

                      In my KVM lab, I created my VIP on my DMZ, then a 1:1 NAT to a Mint box on LAN. Server on DMZ could not ping the VIP successfully. Now I also have block rules on DMZ to prevent traffic to LAN, but I assumed the NAT would bypass that. Perhaps I'm wrong?

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @KOM
                        last edited by

                        Do you have rule that prevents access to your vip?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        KOMK 1 Reply Last reply Reply Quote 0
                        • KOMK
                          KOM @johnpoz
                          last edited by

                          @johnpoz The DMZ, VIP and ubuntu server are all on the same subnet so rules shouldn't matter, but no I don't have anything specific to that VIP.

                          Block to VLAN20 net
                          Block to LAN net
                          Allow DMZ to Any

                          and that's it.

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @KOM
                            last edited by

                            So you still need a rule that allows the nat.. Here I just blocked access on lan to 192.168.3.32

                            And if try and ping 192.168.9.32 it fails.

                            fail.png

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            KOMK 1 Reply Last reply Reply Quote 0
                            • KOMK
                              KOM @johnpoz
                              last edited by

                              @johnpoz I added an Allow rule on DMZ for my VIP and it still doesn't work.

                              Do me a favour and recreate your test going the other way, DMZ to LAN instead of LAN to DMZ? My tiny brain is spinning trying to keep my lab setup, your config and his config all straight.

                              Meanwhile it's lunchtime. Back in a few.

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @KOM
                                last edited by johnpoz

                                Ok flipped it - doesn't matter

                                Put the vip on the dmz interface, setup the 1:1 nat on the dmz interface, created a firewall rule to allow that access to the 9.100 IP..

                                Works just fine..

                                flipped.png

                                For my next trick - I will go wash my car in the rain.. Then water my lawn.. Same sort of nonsense as doing this sort of thing.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                KOMK 1 Reply Last reply Reply Quote 0
                                • KOMK
                                  KOM @johnpoz
                                  last edited by

                                  @johnpoz OK I got it working. I had my allow rule pointing to my VIP instead of the LAN address I was natting to.

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @KOM
                                    last edited by

                                    Yeah the nat rule is evaluated before the firewall rule - but the actual traffic has to be allowed for it to work.. Just like any normal port forward..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    KOMK 1 Reply Last reply Reply Quote 0
                                    • KOMK
                                      KOM @johnpoz
                                      last edited by

                                      @johnpoz I know all of that which makes it extra-stupid on my part.

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        Freyja
                                        last edited by

                                        Hi both, thanks for your investigations.

                                        However, it's not a single IP I would like to nat 1:1 but a whole network.

                                        If you need screens, I'll post them this afternoon.

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Freyja
                                          last edited by johnpoz

                                          And how would you do that when some IPs on the network you want to nat are on device on that L2..

                                          If you have 10.1.10 on A, and 10.1.12 on B you can not 1:1 nat either of those for a whole network.. You would need a 3rd network. Say 10.1.11

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          F 1 Reply Last reply Reply Quote 0
                                          • F
                                            Freyja @johnpoz
                                            last edited by

                                            @johnpoz why that ?

                                            Of course I would not NAT the server IP.
                                            Honestly, it's working with the Pix and it's bugging me it's not working with pfSense/Netgate :(

                                            Should I make a NAT exception for the Server IP and the pfSense IP (if possible)?

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.