Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Incoming NAT to another router on same LAN

    Scheduled Pinned Locked Moved NAT
    7 Posts 2 Posters 730 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Malakym
      last edited by Malakym

      I'm currently setting up a second pfSense instance along side an existing one and having some trouble, though I'm not sure if its my misunderstanding with routing.

      The new one is on a different LAN IP address for now, though will eventually be moved over to the original.

      old .254
      new .250
      both on the same /24

      These have separate WAN connections out to the internet. Neither supply DHCP or DNS.

      I am trying to setup NAT forwarding on the new router before switching over and they won't work as most services are using the old router as their gateway router. If I NAT forward to something that has the new router as its gateway its okay.

      I think I am fundamentally missing something, I thought since both routers are on the same /24 this would be okay.

      I don't think its a firewall issue as I can see the pass lines in filter.log.

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Malakym
        last edited by

        @malakym let me make sure I understand what your trying to do.

        You have this?

        drawing.jpg

        And you have traffic coming into pfs2 from internet, and you want to forward to .100

        If you forward to .101 it works, because its using .250 (pfs2) as its gateway. But when you forward from pfs2 to .100 it doesn't work because its using .254 as its gateway.

        If that is the problem, then the solution would be to source nat the traffic on .250 when it goes to .100 to look like it came from .250 vs public IP of say 4.5.6.7

        This would be done via outbound nat on LAN interface of .250, with source of any and destination .100 to use pfs2 LAN address. You could create an alias that contains all your lan IPs of devices that are still using the .254 as their gateway.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 1
        • M
          Malakym
          last edited by

          Thanks for the detail and you've got the situation spot on.

          Im guessing that means this is normal, though would like to understand furthere. Are the packets coming in with the public IP and the client is trying to go out on their default gateway because its a public IP thus failing?

          I have done the outbound NAT as described and its working well, thank you.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @Malakym
            last edited by johnpoz

            @malakym said in Incoming NAT to another router on same LAN:

            Are the packets coming in with the public IP and the client is trying to go out on their default gateway because its a public IP thus failing?

            Spot on!

            edit: To go a bit further with why and how this could fail.. So when some public IP traffic gets sent on to .100, this would be SYN it would answer how via its default routing to get to the internet, pfs1 - but pfsense1 didn't see the syn, so no state was created. So it seeing the syn,ack would be out of state and fail because of that.

            But even if it did send on the traffic to this public IP. The public IP would see the traffic come back from a different IP.. Hey I sent traffic to 4.5.6.7, why is the return coming from 1.2.3.4 And would also fail..

            edit2: Once you move the gateway of .100 over to your new pfs, you can just remove the outbound nat on the lan on pfs2 and you should be good to go.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            M 1 Reply Last reply Reply Quote 1
            • M
              Malakym @johnpoz
              last edited by

              @johnpoz Cheers.
              For some reason I thought NAT dealt with all this.

              Thanks for the extra info.

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Malakym
                last edited by johnpoz

                @malakym nat does deal with it when going outbound from your client going to the internet. Traffic is natted to your public IP.

                But when you port forward, client sees the traffic come from the public IP.

                What you did with creating the other outbound nat is make it look like the public traffic came from pfs2 lan IP (.250)

                So traffic is sent back to pfs2.. Pfsense 2 said oh I natted this, this is suppose to go to public IP 4.5.6.7, and I have to also nat it back to pfs2 public IP.

                The drawback to this - is your client .100 will see that all the internet traffic coming to him looks like .250, so if your wanting log on the client who is talking to your service vs seeing all the public IPs you would only ever see the .250 address.

                Its not an optimal sort of configuration, but really its the only way to accomplish what your doing. The other way to get it to work would be to create routes on this .100 box saying hey you see traffic from 6.7.8.9 send it to .250.

                But do you know what all public IPs will be that you forward to .100? Unlikely I would assume.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                M 1 Reply Last reply Reply Quote 1
                • M
                  Malakym @johnpoz
                  last edited by

                  @johnpoz said in Incoming NAT to another router on same LAN:

                  But do you know what all public IPs will be that you forward to .100? Unlikely I would assume.

                  Ah, I had thought you meant our own public facing IPs. I can deal with this limitation whilst migrating though.

                  Thanks again for the assistance.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.