Manual NAT. pf LAN -> L3 Switch -> 4 subnets… Do I need to create NAT rules?

  • I am so close to getting this to work.

    ISP gives me: 
    WAN – y.y.y.216 /30
    Pub IPs- x.x.x.224 /27

    pfSense Configuration:
    WAN:  y.y.y.218 /30  (gateway: y.y.y.217 /30)

    LAN_1: /24  -> L3 Switch -> 3 other subnets (,,

    LAN_2: /24

    LAN_3: /24

    I've created the "routes" for those 3 "non native" interface subnets in LAN_1.

    When NAT is set to "Automatic", all 3 LAN interfaces (including the 3 extra subnets in LAN_1)  browse out to the internet and show a Public IP:  y.y.y.218.  This is expected and normal.

    BUT -- I want to use the public IPs now like this:

    LAN_1 to NAT from x.x.x.226

    LAN_2 to NAT from x.x.x.250

    LAN_3 to NAT from x.x.x.229

    First step I did was turn "Automatic NAT" off.  It created my default rules and I saw the option to edit the "translation address" --
    So, next step -- I added some virtual IP's and set them in the NAT rules under "translation address". 
    Everything seemed to work EXCEPT...


    On LAN_1, the network could browse the internet but the 3 other subnets could not - I figured out that they ALSO need their own NAT rules(?)    So I copied the 2 auto-created rules for the network for my, and networks that are attached to that LAN_1 interface --> NOTE:  pfSense put these 6 new rules at the bottom? Does this matter?

    (remember, I already have routes for them in pfSense under "routing" and they worked fine with NAT set to "automatic").

    After I made the NAT rules I now had 4 networks, with rules that needed the SAME "translation address" and that is where the problem is maybe?  Can I not have rules (1 rule for each subnet) that use the same "translation address" VIP?

    It seems like this shouldn't be a problem because with "automatic NAT" every network uses the same WAN IP?  Plus -- Why do I have to create the rules for those 3 "extended" subnets in LAN_1 ONLY when I turn "automatic NAT" off?

    I am so close to getting this to work - I would really appreciate some help!

  • I do the same thing for my lab network. After creating a route and a LAN rule to pass traffic, I used AON (Advanced Outbound NAT) to create a rule to push my lab traffic out the WAN interface. I also have certain hosts using certain VIPs. I would make sure that the rule is exactly like the generated one execpt for the VIP and the subnet. Could you paste a screen shot of the AON and a rule edit within that?

  • Got it working… Since all my LAN subnets need to go out the same VIP - I simply created an NETWORK TYPE ALIAS from the "FIREWALL" tab and then added all 4 of my subnets to that.

    Then adjusted the AON outbound rules to use that alias.  Adjusted the firewall rules to use that Alias.

    It's now working!

    Many thanks to all who helped!

Log in to reply