Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Public IP Multiwan NAT Configuration Question

    Scheduled Pinned Locked Moved NAT
    2 Posts 1 Posters 196 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      alexnyc
      last edited by

      Hello Everyone.

      We have the following setup with PFS+ on Netgate 1541 server:

      1. Multiwan from the ISP via 2 /30 subnets that are connected via PFS WAN1 and WAN2

      2. 2 Public /24's that are statically routed via the above /30s by the ISP. Lets call these Public IP VLANs A and B

      3. 3 NAT /24's. Lets call these VLANS C,D,E

      I have PFS in Hybrid Nat outbound Mode.
      I have NO-NAT rules created for both public VLANs A and B for each WAN interface as described in the PFS Guide

      I have Firewall routes that enable policy based routing for appropriate gateway from each VLAN (I tried Gateway Load balancing but also locking down to a specific gateway WAN1 or WAN2)

      Everything works well - Machines on public IP vlans AB are accessible as per firewall rule
      Machines on NAT vlans CDE are able to get outside using NAT and access everything per firewall rules

      Except:

      Neither 1:1 NAT, nor port forwarding work in any of the following scenarios:

      Scenario 1: 1:1 NAT
      Virtual IP on VLAN A (Public) Configured in PROXYARP mode
      1:1 NAT configured using Public IP Address on VLAN A, NATTING to Private IP on VLAN C. (Example: 3.3.3.3 Public on VLAN A maps to 10.10.3.3 on VLANC)
      Attempting to reach 3.3.3.3 from the internet - nothing. PFS does not NAT the traffic. Firewall configured to allow access for both.

      Scenario 2: Port forwarding with Virtual IP
      Virtual IP on VLAN A (public) configured as IP ALIAS (i.e. PFS owns the IP)
      Port forwarding ANY-ANY configured from VLAN A (3.3.3.3 example) to VLAN C (10.10.3.3).

      Attempting to reach 3.3.3.3 from the internet works, but PFS is hit (for example get pfs admin on port 443), but actual port forwarding does not work at all.

      Can anyone point out what is wrong with this setup and why 1:1 NAT is not working in this case? I suspect it has something to do with the way public subnets are hosted on PFS with NAT disabled but this is just my guess.

      Any help will be appreciated!

      1 Reply Last reply Reply Quote 0
      • A
        alexnyc
        last edited by

        Here is the visual of the configuration with made up Public IPs

        2d658bdd-b6ea-48ef-820a-52fb08bec5b8-image.png

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.