Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT)

riahc8 · May 27, 2023, 9:59 AM

Ok I officially tap out. Too much work, stress and I don't need to deal with this at home

My ISP router is 192.168.22.254...i have 7 ports on my pfSense: let's focus on the WAN and LAN interfaces.

How do I setup my WAN to get the internet connection from my ISP router? Also, can I just disable NAT on the pfSense to avoid the double NAT? Will the devices on the LAN interface on the pfSense work? What do I do with VPN setup on the pfSense?

Thank you very much

the other · May 27, 2023, 1:28 PM

hey there,
I am using NAT on pfsense as well, double NAT never bothered me with my individual setting here...

So:
on your ISP router give pfsense a fixed IP (iE ISP router has 192.168.22.254, pfsense gets .253)

On your pfsense:
Interface WAN > General choose Static IPv4
Interface WAN > IPv4 settings chose IPv4 for WAN (iE .253) and set gateway (ISP router's IP)

Interface LAN > General choose Static IPv4 for that interface
Interface LAN > Static IPv4 settings choose NONE for upstream gateway, enter your IPv4 above...

Firewall rules: do NOT activate "block private networks" since your ISP router is in a private network...

NAT: I have hybrid NAT mode...

That should be about it...considering IPv4.
:)

SteveITS · May 27, 2023, 1:14 PM

@riahc8 if you’re trying to connect to a VPN server on pfSense you’ll need to forward the ports in your ISP router, or make yours the ISP router’s DMZ to forward all ports.

Re: "block private networks" on WAN that’s for inbound and actually isn’t needed to connect to the ISP router from pfSense LAN. The open state will allow the response.

the other · May 27, 2023, 1:14 PM

@SteveITS hey there,
I agree to 100 % considering my "block private" remark...I only got that as well for using VPN...my mistake, did not want to confuse anyone...
:)

johnpoz · May 27, 2023, 1:32 PM

@the-other said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Firewall rules: do NOT activate "block private networks" since your ISP router is in a private network...

The only time this would "matter" is if you had devices on this rfc1918 address space between your isp device and pfsense. And you wanted to be able to access stuff behind pfsense from this network..

can I just disable NAT on the pfSense to avoid the double NAT?

Would depend on your isp device.. But most likely not - for one this isp device would have to auto nat these downstream networks, it most likely would not do that - and only nat the network its attached to, ie your 192.168.22 network, some downstream network say 192.168.11/24 might not be natted by this isp device to your public IP.

Even if it did nat anything coming into its lan side.. How would it know how to send traffic back to say a 192.168.11.x address? You wold have to be able to put routes on the isp saying hey to get to 192.168.11 talk to pfsense IP on the 192.168.22 network.. ISP gateway devices most likely will not support such a feature.

Overall running double nat most likely will not be any sort of issue for most users.. Its a bit more complicated if you want to run servers behind pfsense where you would have to setup double port forwards, one on your isp to pfsense wan IP, and then another on pfsense to the server behind it.

Nat reflection most likely would be pita, prob not work. But overall most users don't have any problems with it.. There are people running behind triple or even quadruple nat.. While it is not optimal - its not the end of the world either.

If you use UPnP - that most likely not going to work either, etc.

riahc8 · May 28, 2023, 4:30 AM

First, thank you all for the help

I also have to disable the firewall on the ISP router

johnpoz · May 28, 2023, 4:30 AM

@riahc8 Is that a question or a statement?

riahc8 · May 28, 2023, 7:17 AM

@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@riahc8 Is that a question or a statement?

That would be a statement. This way I allow all traffic to the pfSense and from there....handle it

When setting this up, I can still have devices connected to the original ISP router correct?

johnpoz · May 28, 2023, 10:17 AM

@riahc8 For port forwarding, yeah isp routers call that dmz host, etc.. where it forwards all traffic to specific IP behind it. yeah you would most likely want to do that if you plan doing any port forwarding on pfsense.

riahc8 · May 28, 2023, 12:12 PM

@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@riahc8 For port forwarding, yeah isp routers call that dmz host, etc.. where it forwards all traffic to specific IP behind it. yeah you would most likely want to do that if you plan doing any port forwarding on pfsense.

From what Im seeing on this ISP router, port forwards automatically opens up the FW rule.

VPN is working :)

NAT Loopback isnt but.....I dont know if I currently use it for something although would be niice

johnpoz · May 28, 2023, 12:21 PM

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

NAT Loopback isnt but.

Nat reflection or loopback can be problematic for sure in a multinat environment.. Your public IP sits on the isp device.. You would have to set it up on there, but even if worked going to be hairpin nightmare..

Nat loopback or reflection is a horrible work around to a specific problem and should be avoided whenever possible.

The only time it really is required to get something to work is when the client wanting to go there does not use local dns, or is hard coded to go to some public IP, etc.

Getting to something that is local on your network anyway - it is better to just go to the local IP directly, or have whatever fqdn your trying to go to resolve to the local IP vs the public IP, that you would have to reflect back in, creating hairpin traffic and not very optimal.

riahc8 · May 28, 2023, 1:55 PM

Is there a way to get it to work? Just noticed that I have a bunch of Nagios checks that depend on it :( Dont want to do it all over again

riahc8 · May 28, 2023, 1:58 PM

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Is there a way to get it to work? Just noticed that I have a bunch of Nagios checks that depend on it :( Dont want to do it all over again

Pf, I made a DNS entry un my Pi-Hole pointing to the local address...

johnpoz · May 28, 2023, 1:59 PM

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Nagios checks that depend on it

Checking what exactly.. I would assume your nagios is checking stuff on your local network - why would you use your public IP to get to stuff that is local?

Even if nat reflection worked for what your doing, its not really a valid check that public could get to it.

I would take the time to setup your nagios to check the local IP of what your wanting to check, or use a fqdn for your different things that resolve to the actual local IP of what your wanting to talk to for a check of something.

riahc8 · May 28, 2023, 7:14 PM

@johnpoz said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Nagios checks that depend on it

Checking what exactly.. I would assume your nagios is checking stuff on your local network - why would you use your public IP to get to stuff that is local?

Even if nat reflection worked for what your doing, its not really a valid check that public could get to it.

I would take the time to setup your nagios to check the local IP of what your wanting to check, or use a fqdn for your different things that resolve to the actual local IP of what your wanting to talk to for a check of something.

(I think) I fixed it: My DDNS now points to my local IP with a dns entry on the Pi-Hole

Dobby_ · May 28, 2023, 7:45 PM

@riahc8

How do I setup my WAN to get the internet connection from my ISP router?

Connect the pfSense`s WAN port to one
LAN port of the ISP router. If there is no
switch in game and the pfSense is
connected directly to that LAN port you
could try out using "Exposed host", but
only on that port and for the pfSense!
Not for the entire ISP router!

Also, can I just disable NAT on the pfSense to avoid the double NAT?

NAT on pfSense, is a later process in the pf
(packet filter).

Will the devices on the LAN interface on
the pfSense work?

pfSense DHCP: On
ISP router DHCP: Off

What do I do with VPN setup on the pfSense?
If you are using the "Exposed host" method, all
traffic will be reaching then the WAN port from
the pfSense firewall.

riahc8 · May 31, 2023, 8:32 PM

@Dobby_ said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Will the devices on the LAN interface on
the pfSense work?

pfSense DHCP: On
ISP router DHCP: Off

In my case, I need to leave both on as devices are hanging off the ISP router

riahc8 · Jun 8, 2023, 11:06 AM

@riahc8 said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

@Dobby_ said in Setup pfSense behind a ISP router that cannot be put into bridge mode (Double NAT):

Will the devices on the LAN interface on
the pfSense work?

pfSense DHCP: On
ISP router DHCP: Off

In my case, I need to leave both on as devices are hanging off the ISP router

Related subject: https://forum.netgate.com/topic/180704/access-network-behind-a-double-nat