Managing firewall rules for NAT

recvfrom

I anticipate adding NAT port-forwarding for a growing set of isolated instances, say, up to 128, each using a disparate, non-contiguous set of ports. Each one will have a unique virtual IP address on the WAN interface mapped to a unique internal redirect target IP address in a range covered by a CIDR block, e.g., /25. What is the safest and most efficient way to add these without generating 100s of firewall rules (even if I need 100s of NAT rules)?

Is it safe to add a firewall rule per destination port on the WAN interface for the internal target IP range/block and then slowly add the individual NAT rules (one per destination IP+port combination), while changing Filter rule association -> Add associated filter rule to None? The firewall rule references RFC-1918 addresses, but without individual NAT rules per redirect target it should not have any effect for unused address space/not-yet-deployed instances, or am I wrong?

An alternative would be to add a firewall rule per port referencing an IP alias instead of a CIDR block, and slowly expand the alias. For example, create a sequence starting with: 1) a single /32; 2) convert to a /31; 3) use a /31 and a /32; 4) convert to a /30; 5) /30 and a /32; etc.

Or should I not worry at all and let the firewall rules grow like a weed? :)

Thanks in advance for any insight or advice!

tinfoilmatt

Is it safe to add a firewall rule per destination port on the WAN interface for the internal target IP range/block and then slowly add the individual NAT rules (one per destination IP+port combination), while changing Filter rule association -> Add associated filter rule to None?

Yes. A single firewall rule is fine. No need to 'associate' firewall rules with NAT rules.

luckman212

If you're using pfSense+, Nexus UI will generally make managing larger sets of rules faster.

Also, you didn't say, but if you have the v4 address space available, 1:1 NAT could help reduce the number of outbound NAT rules and lower complexity.

recvfrom

@tinfoilmatt thanks, I'll do it this way!

recvfrom

@luckman212 I prefer port-specific NAT rules to minimize attack surfacea, and since it will only be about 5 with a CIDR block, it won't add much complexity.