Double NAT issues
-
I have router from my ISP (that has to be left alone) then a pfsense, and then my main core switch that is doing all my routing. Switching voip systems and they did a test and said I had double nat, which listed my pfsense address and main switch address. The main switch gets routed to my pfsense then it routes out to the ISP router. I can't seem to just turn off NAT at the pfsense it seems, I feel like I am missing something simple.
The lan side pfsense ip is 10.250.0.1 goes to 10.250.0.2 transit ip goes to core switch with multiple vlans, the wan ip of pfsense is to 164.x.x.253 then goes to 164.x.x.254 isp gateway which I can't get rid of because of some other management services, how can I get rid of using nat on the pfsense then. Any suggestions Thanks
-
@rutherforda Firewall - NAT - Outbound NAT mode - Disable Outbound NAT rule generation?
-
@KOM when I do that, all traffic to the internet stops.
-
@rutherforda said in Double NAT issues:
how can I get rid of using nat on the pfsense then. Any suggestions Thanks
Your problem will most likely be your isp router doesn't know about these downstream networks, so can't route them. Also even if it had routing setup, would it nat the other networks or only what it thinks is it lan network, etc. I would be surprised really if some isp device could even do routing.
Your best solution here is to just put your isp device into bridge mode - so that pfsense would get the public IP on its wan.
As to getting unsolicited traffic to device behind pfsense when your in a double nat.. Either setup the forwards in your isp device to send to pfsense wan IP, and then handle your forwards there. Or if your isp device has what often called a dmz host, where you setup pfsense wan IP as this. Now the isp device sends all unsolicited traffic it sees hitting its wan to pfsense IP, where you can control the forwards.
This can work even with double nat.
edit: "the wan ip of pfsense is to 164.x.x.253" so your not behind a double nat?? If you only have 1 public IP, you need nat. 164.x.x.x is public space..
-
@rutherforda Comcast?
Maybe this? https://docs.netgate.com/pfsense/en/latest/recipes/route-public-ip-addresses.html#routing-public-ip-addresses
-
the wan ip of pfsense is to 164.x.x.253" so your not behind a double nat?? If you only have 1 public IP, you need nat. 164.x.x.x is public space.
So the internal network is 10.1.x.x that goes to gateway 10.1.0.254 (the l3 switch for routing) then vlans on transit 10.250.0.2 to the pfsense 10.250.0.1 then wan side for internet. The voip company said that it was double natted because of the 10.1.0.254 (l3 switch), and 10.250.0.1 (pfesne lan) that those were the double nat??. That's were I am getting stuck. Any thoughts/suggestions? Thanks for all the help
-
@rutherforda a route is not a nat - unless your natting at your switch, which maybe you are?
Did you setup routes in pfsense to these downstream networks hanging off your switch? What rule do you have on the lan network - is it only the lan subnet as source?
For you to do multiple networks on your L3 switch, you would either be routing or natting. If your natting on your switch - then yeah its a double nat. Either way unless you have like 10ge between your segments on your switch, why would you not just route at pfsense so you could actually firewall between your segments.
Privacy Policy · Cookie Policy