Incoming NAT to another router on same LAN

Malakym · Dec 17, 2021, 11:29 AM

I'm currently setting up a second pfSense instance along side an existing one and having some trouble, though I'm not sure if its my misunderstanding with routing.

The new one is on a different LAN IP address for now, though will eventually be moved over to the original.

old .254
new .250
both on the same /24

These have separate WAN connections out to the internet. Neither supply DHCP or DNS.

I am trying to setup NAT forwarding on the new router before switching over and they won't work as most services are using the old router as their gateway router. If I NAT forward to something that has the new router as its gateway its okay.

I think I am fundamentally missing something, I thought since both routers are on the same /24 this would be okay.

I don't think its a firewall issue as I can see the pass lines in filter.log.

johnpoz · Dec 17, 2021, 11:56 AM

@malakym let me make sure I understand what your trying to do.

You have this?

login-to-view

And you have traffic coming into pfs2 from internet, and you want to forward to .100

If you forward to .101 it works, because its using .250 (pfs2) as its gateway. But when you forward from pfs2 to .100 it doesn't work because its using .254 as its gateway.

If that is the problem, then the solution would be to source nat the traffic on .250 when it goes to .100 to look like it came from .250 vs public IP of say 4.5.6.7

This would be done via outbound nat on LAN interface of .250, with source of any and destination .100 to use pfs2 LAN address. You could create an alias that contains all your lan IPs of devices that are still using the .254 as their gateway.

Malakym · Dec 17, 2021, 12:33 PM

Thanks for the detail and you've got the situation spot on.

Im guessing that means this is normal, though would like to understand furthere. Are the packets coming in with the public IP and the client is trying to go out on their default gateway because its a public IP thus failing?

I have done the outbound NAT as described and its working well, thank you.

johnpoz · Dec 17, 2021, 12:41 PM

@malakym said in Incoming NAT to another router on same LAN:

Are the packets coming in with the public IP and the client is trying to go out on their default gateway because its a public IP thus failing?

Spot on!

edit: To go a bit further with why and how this could fail.. So when some public IP traffic gets sent on to .100, this would be SYN it would answer how via its default routing to get to the internet, pfs1 - but pfsense1 didn't see the syn, so no state was created. So it seeing the syn,ack would be out of state and fail because of that.

But even if it did send on the traffic to this public IP. The public IP would see the traffic come back from a different IP.. Hey I sent traffic to 4.5.6.7, why is the return coming from 1.2.3.4 And would also fail..

edit2: Once you move the gateway of .100 over to your new pfs, you can just remove the outbound nat on the lan on pfs2 and you should be good to go.

Malakym · Dec 17, 2021, 12:50 PM

@johnpoz Cheers.
For some reason I thought NAT dealt with all this.

Thanks for the extra info.

johnpoz · Dec 17, 2021, 12:58 PM

@malakym nat does deal with it when going outbound from your client going to the internet. Traffic is natted to your public IP.

But when you port forward, client sees the traffic come from the public IP.

What you did with creating the other outbound nat is make it look like the public traffic came from pfs2 lan IP (.250)

So traffic is sent back to pfs2.. Pfsense 2 said oh I natted this, this is suppose to go to public IP 4.5.6.7, and I have to also nat it back to pfs2 public IP.

The drawback to this - is your client .100 will see that all the internet traffic coming to him looks like .250, so if your wanting log on the client who is talking to your service vs seeing all the public IPs you would only ever see the .250 address.

Its not an optimal sort of configuration, but really its the only way to accomplish what your doing. The other way to get it to work would be to create routes on this .100 box saying hey you see traffic from 6.7.8.9 send it to .250.

But do you know what all public IPs will be that you forward to .100? Unlikely I would assume.

Malakym · Dec 19, 2021, 12:38 AM

@johnpoz said in Incoming NAT to another router on same LAN:

But do you know what all public IPs will be that you forward to .100? Unlikely I would assume.

Ah, I had thought you meant our own public facing IPs. I can deal with this limitation whilst migrating though.

Thanks again for the assistance.