Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1:1 Nat routing back to firewall

    Scheduled Pinned Locked Moved NAT
    12 Posts 3 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      trever
      last edited by

      I have a LAN and a WAN. I have a block of IP's from my ISP. I have setup virtual IP's and enabled 1:1 NAT. Everything works fine externally. However, computers on my LAN are being redirected back to the firewall itself. So if I try to ssh to one of the hosts from internally it ends up going to the firewall itself and not the machine that the VIP and 1:1 NAT points to. So I end up sshing to the firewall itself and not the server I am trying to get to. As I said all works fine from outside of my network. This is also a mail server so I am unable to connect with the mail client because it is ending up at the firewall and not the host specified in the 1:1 NAT configuration.

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @trever
        last edited by viragomann

        @trever
        Add DNS host overrides for the host names you want to access and point them to the proper internal destination IPs.

        T 1 Reply Last reply Reply Quote 0
        • T
          trever @viragomann
          last edited by

          @viragomann That did not help either. It is still ending up at the firewall itself.

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @trever
            last edited by

            @trever
            Consider to clear the DNS cache on the client.

            1 Reply Last reply Reply Quote 0
            • T
              trever
              last edited by

              I have tried that as well. If I ssh to the external ip I end up at the firewall. If I ssh to the internal IP I get to the server I am trying to get to. So it appears to be an issue at the firewall and not in DNS.

              S V 2 Replies Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @trever
                last edited by

                @trever On the 1:1 NAT entry settings page, is "NAT reflection" enabled?

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote ๐Ÿ‘ helpful posts!

                T 1 Reply Last reply Reply Quote 0
                • T
                  trever @SteveITS
                  last edited by

                  @steveits It is set to Use System Default

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    SteveITS Galactic Empire @trever
                    last edited by

                    @trever And in System/Advanced/Firewall & NAT, is reflection enabled? Enabling it there enables it for all NAT rules.

                    Reflection allows using NAT forwards from LAN.

                    See the note towards the end of this section:
                    https://docs.netgate.com/pfsense/en/latest/nat/1-1.html#configuring-1-1-nat

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote ๐Ÿ‘ helpful posts!

                    T 1 Reply Last reply Reply Quote 0
                    • T
                      trever @SteveITS
                      last edited by

                      @steveits Neither of these options are checked.

                      Enable NAT Reflection for 1:1 NAT
                      Enable automatic outbound NAT for Reflection

                      1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @trever
                        last edited by

                        @trever said in 1:1 Nat routing back to firewall:

                        If I ssh to the external ip I end up at the firewall.

                        I see, so that has neither to do anything with DNS host overrides nor with NAT reflection.
                        When you ssh to an public IP and get to pfSense, the only reason I can think of is that the packets are redirected somehow.
                        Are there any port forwarding on the internal interface?

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @viragomann
                          last edited by

                          @viragomann But he's trying to access the WAN IP from LAN. That seems to me like it needs reflection to work. NAT rules on WAN would only apply to packets arriving from the Internet.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote ๐Ÿ‘ helpful posts!

                          V 1 Reply Last reply Reply Quote 0
                          • V
                            viragomann @SteveITS
                            last edited by

                            @steveits said in 1:1 Nat routing back to firewall:

                            But he's trying to access the WAN IP from LAN. That seems to me like it needs reflection to work.

                            Yes, you're right. I didn't read correctly.

                            @trever
                            But why are you using the external IP for accessing an internal device? The suggested way is to access it using an FQDN together with internal DNS host overrides. So from within your network the FQDN is resolved to the internal IP and accessing it should be work without NAT reflection.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.