Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    NAT hairpin not working

    Scheduled Pinned Locked Moved NAT
    7 Posts 2 Posters 103 Views 2 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N Offline
      naiw
      last edited by

      I am having some issues with NAT hairpin not working.

      Up to about 2 months ago, everything was working. After a reboot of my appliance, NAT hairpin does not work.

      All other NAT rules from the outside world are functioning, but I cannot get my FQDN to work from the LAN.

      Does anyone have any suggestions?

      I am currently running pfSense 2.81

      ea080a78-5731-4bfc-93d5-f78e2d1abd35-image.png

      tinfoilmattT 1 Reply Last reply Reply Quote 0
      • tinfoilmattT Offline
        tinfoilmatt LAYER 8 @naiw
        last edited by

        Let's see the NAT rule (at least).

        N 1 Reply Last reply Reply Quote 0
        • N Offline
          naiw @tinfoilmatt
          last edited by

          @tinfoilmatt the rule in particular with the issue are rustdesk

          9ed21a84-9e32-4e2d-b818-ae2fb8cd52af-image.png

          tinfoilmattT 1 Reply Last reply Reply Quote 0
          • tinfoilmattT Offline
            tinfoilmatt LAYER 8 @naiw
            last edited by

            Is interface "BELLFIBE" a WAN interface?

            What interface is attached to the subnet the RustDesk server is connected to (i.e., 172.16.0.2[/24?]), is it "LAN"?

            N 1 Reply Last reply Reply Quote 0
            • N Offline
              naiw @tinfoilmatt
              last edited by

              @tinfoilmatt My pfsense WAN interface the physical connection. The BELLFIBE is an authenticated PPPoE vlan connection on the physical pfSense interface which is then the WAN interface.

              My LAN is on 172.16.0.1

              tinfoilmattT 1 Reply Last reply Reply Quote 0
              • tinfoilmattT Offline
                tinfoilmatt LAYER 8 @naiw
                last edited by

                Not entirely sure if relevant at all but, seeing that you have a linked firewall rule and reading through the documentation on the "Filter Rule Association" option, I found the following note in the documentation:

                Rules using Pass can only work on the interface containing the default gateway for the firewall, they do not work with Multi-WAN.

                Network Address Resolution / Port Forwarding Risks

                Would be helpful to see the NAT rule's actual configuration.

                N 1 Reply Last reply Reply Quote 0
                • N Offline
                  naiw @tinfoilmatt
                  last edited by

                  @tinfoilmatt I don't have a mutil WAN.

                  • My ISP does not support bridging their modem to my pfSense

                  • Searching the internet about 5 years ago I found this setup on how to bypass their modem https://prnt.sc/vwcy02

                  • This works and so has the NAT hainpin until about 2 months ago

                  • This is the NAT rule's configuration
                    7a23e612-4a99-405f-bc51-b221ca0d193e-image.png

                  • The BELLFIBE interface is my default gateway
                    fb77da05-d9fe-4b7c-99c6-a59990797d61-image.png

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.