Automatic outbound NAT showing old subnets and not picking up new ones

ppcs-sysadmin

Is it safe to delete existing outbound nat's created by automatic for subnets that no longer exist but still show up in the list?
Is there an upper limit to the max number or nat's it can create? New subnets are not getting added by default, is there a command tore-run automatic NAT?

johnpoz

@ppcs-sysadmin huh? If I create a new network, auto adds it. But if I delete it, it should be removing it as well

So for example.. What I show before, then created a 192.168.5.0/24 network gave pfsense an IP.. It gets added to the outbound nat. I then delete said interface and its removed from the outbound nat.

Are you saying in auto mode, you have outbound nats listed for networks you have no interface on pfsense set to?

Are these networks via downstream gateway and route?

ppcs-sysadmin

What I am seeing is lots of disabled static routes and while my new subnet is in the auto section, it appears not to work. The only difference is instead of a 192.168.x.x address, it is a 10.118.x.x address if that makes it function differently.

johnpoz

@ppcs-sysadmin said in Automatic outbound NAT showing old subnets and not picking up new ones:

lots of disabled static routes

If its just disabled? Then I would think it could still be listed. But when you remove it then it should go away.. If your no longer using the routes why not just delete them?

Doesn't matter what the network is, could be public IP space even.. With auto it should be added to nat to the wan interface, etc.

ppcs-sysadmin

@johnpoz
When in Auto only mode I assume all the grey'ed out lines are disabled. The auto box does show the interface's information but traffic never reaches the WAN

johnpoz

@ppcs-sysadmin that doesn't look like your in auto mode.. You hit save after changing to auto?

When you do like disable outbound nat or something it would throw your auto into mapps and they would be like gray like that

If I then turn auto back on

See how it says automatic rules - you need to make sure you hit save and apply, etc..

You can then delete those old mappings by clicking the trash can icon

ppcs-sysadmin

I deleted the old statics then rebooted the firewall. The auto shows all my subnets going to the WAN but it did not fix the issue.
All 192.168.* subnets nat out to the WAN. My one single 10.* subnet does not.
Still feels this as something to do with using a 10.x.x.x network. I'll try to substitute a 192.168 as a test if I can't find other items to try tonight

johnpoz

@ppcs-sysadmin Do you have some rule that forces 10 out some other gateway? You can use a 10.network dude..

You see your network in the auto nat, then it would be natted - what are the rules you have on this interface you created?

Why do you have what address your going to nat to blocked out.. So your running vips? On your wan? So your saying the traffic is leaving your wan with the source 10.x address? Sniff on your wan - show your state table, etc..

Here - I added a 10.x network..

Working just fine - see my state where it natted my 10.1.2.100 address to my wan IP..

Here is answers coming back

ppcs-sysadmin

Rookie mistake. Testing using a cell phone and missed the DNS issues on the new subnet ;(
Thanks for being so responsive.