Route internet from NAT

Jsetive

Hello,

I have one pfsense with problems getting updates, the ISP said that i need to configure the public IP as IP Aliases and put local ip as gateway and route everything trought them, the internet in Office is working, but i can't download packages and check if exist updates.

IP: 100.64.136.210
NETMASK: /30
GTW IP: 100.64.136.209

WAN IF:

Static Routes:

Outbound NAT:
Vlan 10 is the local network.

I can't ping from WAN IF:

But i can from VLAN10 IF:

Thanks in advance

SteveITS

@Jsetive your WAN gateway is set to None.

I guess you created your static route manually? Just set a gateway.

stephenw10

Mmm that static route seems odd there. That should just be the default route anyway. Just add the gateway to the WAN directly as @SteveITS said.

Did you add that public IP as a VIP on WAN? Can you ping from that directly?

You may need an outbound NAT rule for traffic from the firewall itself if the ISP will not correctly route traffic from the CGN address.

Steve

Jsetive

Do you mean set this?

This was the old setup, i've remove since i got same state with and without upstream gateway set.

Did you add that public IP as a VIP on WAN? Can you ping from that directly?

Yes

stephenw10

Ok well I would go back that setup with the gateway on WAN dircetly. That will add a default route and the static route is just confusing.

Do you have outbound NAT in hybrid or manual mode? You should use hybrid mode there otherwise none of the auto rules will be generated.

Jsetive

@stephenw10

The outbund NAT is in Hybrid.

SteveITS

@Jsetive Traceroute to 8.8.8.8 from WAN.

Jsetive

@SteveITS

From WAN IF i can't made one traceroute, but i can from IP:

SteveITS

@Jsetive how far does the traceroute on WAN get?

stephenw10

It sounds like the /30 CGN subnet is used for transport only and it not routed (or NAT'd) by the ISP.

In which case you would need to source traffic from the firewall itself from the public VIP.

To do that you need an outbound NAT rule that matches it.

An alternative here might be to set the public IP as the primary WAN address wit the CGN address (100.64.136.210) as the VIP.

To add the gateway to the WAN you would need to set the advanced gateway option: Use non-local gateway

This is a very unusual config!