[solved] Is double NAT bad if pfSense should not be the first router?
-
I am calling @johnpoz on this.
I have double NAT, where there is another router in front of pfSense, pfSense is the exposed host of this first router. Everything works (even IPv6 prefix delegation).
Now I disabled almost all of the outbound NAT in pfSense, I had a route to my pfSense networks already in place in that first router.
The question: Do I gain any benefit from doing this or is it pointless. I want to keep the first router where it is.
Second question: If I don't NAT, the Static Port Icon shouldn't be there, right?
-
@Bob-Dig so your first router is natting your pfsense lan side network(s)? So its not a soho type router - because not aware of any soho router that will do that.
Off the top not thinking of any real advantage to this.. But can see some draw backs - if your wanting to talk to stuff on your pfsense wan, you would see asymmetrical.. While if you were natted, the dest you were talking to would respond to the wan IP of pfsense and it wouldn't be asymmetrical.
As to static nat if not natting? Not sure - but the source port shouldn't change if your not natting. I have never played with this sort of scenario.. I could I guess with one of my VM pfsense installs.. Which currently are double natting.
-
@johnpoz said in Is double NAT bad if pfSense should not be the first router?:
@Bob-Dig so your first router is natting your pfsense lan side network(s)? So its not a soho type router
I got mine for around 100 bucks back in the day, it is a soho type router around my place.
-
@johnpoz said in Is double NAT bad if pfSense should not be the first router?:
But can see some draw backs - if your wanting to talk to stuff on your pfsense wan, you would see asymmetrical.. While if you were natted, the dest you were talking to would respond to the wan IP of pfsense and it wouldn't be asymmetrical.
You told me before so there is a rule for that.
-
@Bob-Dig so it will just nat any source network that talks to it? Or you have to setup the natting of the downstream networks, or allow for them in firewall rules?
-
@johnpoz said in Is double NAT bad if pfSense should not be the first router?:
so it will just nat any source network that talks to it?
This!
Too bad I don't gain anything.
-
@johnpoz Now I encountered a problem. I have another pfSense behind my first pfSense, which is behind that other router. Now this second pfSense (which is the third router) has no internet. And I have no clue why this isn't working anymore, it still does NAT. Now I am thinking about burning this down. Maybe you have an idea what the culprit could be?
-
@Bob-Dig so why would anyone want/need to setup 3 nat routers? And you don't want any of the 2 down stream routers to nat? Or you only want the 3rd one to nat to the 2nd router, and then it not to nat and only have your 1st router nat?
You could for sure setup router A, and then have B downstream of A, and C downstream of B and all work.. you could also have a D and an and E.. What is the end goal? Why would you need to setup so many routers downstream of each other on your local network?
-
@johnpoz said in Is double NAT bad if pfSense should not be the first router?:
Or you only want the 3rd one to nat to the 2nd router, and then it not to nat and only have your 1st router nat?
This!
Why would you need to setup so many routers downstream of each other on your local network?
Like I said, probably the best thing to burn it down. But now I am curious why it is not working.
The reason why I did it like this, I want to sync some pfSense settings between this third pfSense and a pfSense on a VPS on the internet. Both have similar tasks, are like siblings.
Interesting, as soon as I disable those noNAT rules on the first pfSense and than reloading the WAN interface on the second, it has internet. I almost thought I got a different problem in the meantime.
-
johnpoz LAYER 8 Global Moderatorlast edited by johnpoz Mar 30, 2024, 12:57 PM Mar 30, 2024, 12:57 PM
@Bob-Dig if your going to nat at your 1st router multiple downstream networks, you would need have routes setup at that router, and you would need routes setup on your 2nd router.
Lets say you have this
internet - 1st - 192.168.1/24 -- 2nd 192.168.2/24 -- 3rd 192.168.3/24
So 1st would need routes to both 2 and 3 or mask that includes both sending to 2nd routers 1.x address.
2nd router would need route to the 3 network pointing at 3rd routers 2.x address.
And firewall rules at all 3 routers would need to allow for all downstream networks.
-
@johnpoz Is this all true even if the third does its NAT?
Also I noticed that on my first pfSense (the second router) I can ping 9.9.9.9 from any interface other than the one, which is the WAN for my third router. Doesn't make any sense to me.
-
@Bob-Dig said in Is double NAT bad if pfSense should not be the first router?:
Is this all true even if the third does its NAT?
No if the 3rd router is natting to is 2.x address, then routing wouldn't need to include the 3rd router network in either the 1st router or the 2nd router.. Because anything behind the 3rd router is just going to look like a client of the 2nd router.
-
@johnpoz I ditched that buggy interface in the first pfSense, even the whole vlan, and built a truly new one and it is working just fine. Sometimes pfSense can get messy.
