Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Virtual IP NAT reflection

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    7 Posts 4 Posters 6.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tuaris
      last edited by

      I am getting ready to setup a new pFsense box for a web/email hosting infrastructure.  My needs are more met by the features available in the 2.0 series and I am considering using the 2.0 RC-3 for production.  The most important feature here is NAT reflection.

      1. Would you consider the basic functions (NAT & Routing) of the 2.0 RC-3 stable enough be used in a production environment?
      2. The only advanced feature I would need (for now) is NAT Reflection for 1:1 (or virtual IP's), and Port Forwards.  Is this feature functional without any known or foreseen issues?

      Thanks

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        @tuaris:

        1. Would you consider the basic functions (NAT & Routing) of the 2.0 RC-3 stable enough be used in a production environment?

        Yes. Even more so than 1.2.3 in almost every case.

        @tuaris:

        1. The only advanced feature I would need (for now) is NAT Reflection for 1:1 (or virtual IP's), and Port Forwards.  Is this feature functional without any known or foreseen issues?

        I haven't seen 1:1 reflection work, personally. NAT reflection in general works better than it did on 1.2.3, but be aware that it only works properly for TCP. NAT reflection for UDP hasn't ever worked properly that I'm aware of, even on 1.2.3.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          I never could wrap my head around how there would be an actual NEED for nat reflection, I see it as a shortcut or a lazy way to have local machines access a inside ip by the public IP normally because admin is too lazy to setup name resolution correctly for other inside machines that want to access the resource that is meant for outside access.

          If you don't mind could you explain your NEED for NAT reflection..  I am most curious to why you believe you NEED it, maybe you do and I am just not able to think of the scenario where it would be required.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            There are some cases out there where devices require an IP instead of a hostname (silly, I know…) or in the case of certain game servers, the server is listed in a public list by its IP, and if you try to connect with a console on the "inside" to the server in the list, it won't work. DNS doesn't help there...

            In almost every case, however, Split DNS is better.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              Those scenarios do indeed make sense.  And now that you mention them its DUH why did they not come to mind when I was racking my brain for when nat reflection would actually be needed.

              Thanks!  That quenches my curiosity thirst ;)

              I can understand both of those scenarios, but they still seem pretty lame - why would you actually require the connection to be an IP?  And why would you not use DNS to resolve a game server your trying to connect too ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • T
                tuaris
                last edited by

                A web, DNS, email, mysql infrastructure hosting hundreds of domains is placed behind pFsense.  In the following setup web, dns, mysql, and mail are each on their own dedicated server.  NAT is setup so that 1 IP address can shared across web, email, and DNS.

                Now, consider the following cases:

                Multisite Drupal based websites need cron.php run every hour.  The cron.php script must be accessed using the hostname. (http://www.domain1.tld/cron.php, http://www.domain2.tld/cron.php, http://www.domain3.tld/cron.php).  DNS will resolve using the external IP address.

                A web form is filled out and sends email to a hosted domain (someone@domain1.com), DNS resolves the MX to the external IP address.

                Sure, split DNS could solve the issues, but would it really be feasible to run split DNS for hundreds of domains?

                1 Reply Last reply Reply Quote 0
                • G
                  genic
                  last edited by

                  tuaris, a mix dns would be a PIA, but fruitful…however, i am running internal DNS with reflection/NAT on many websites, mail servers, etc. i have yet to run into a problem with RC3.

                  i only allow dns through my dmz and all is grand. reverse lookups havent had a problem.

                  ofcourse i have more than one static (200+ statics at the moment) ...but i still havent run into a problem you might be worrying aboot.

                  also, the hardware i am running is prehistoric compared to the hosting environment..and it runs like a top.

                  i replaced TWO paloalto 5500's with pfSense (not load balanced, but failover setup) ...and not only do i have LESS work to do compared to the paloalto's ...i have better performance on VPN, email, and www.  ...so...i was a skeptic at first, but i have quickly become a big ol fan of pfSense.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.