NAT source rewrite from External sources (WAN) to (LAN) interface IP address

shon · Feb 2, 2012, 9:16 PM

I'm trying to figure out how to rewrite the SRC IP of external clients hitting my internal Apache webserver to the LAN interface IP address of the firewall.

1. _______
|| ||
||||
|__|
HTTP request to example.com = 4.4.4.4
External IP of client: 5.5.5.5

WAN IP
4.4.4.4
_____________ _____________
| pfsense 2.0.1 | 3. Rewritten SRC IP request from the firewall | Apache |
| | –------------------------------------------------------------------------- | Web |
| | src ip 192.168.1.1 dst IP 192.168.1.10 dst port 80 -> | Server |
| | --------------------------------------------------------------------------- | |
| ____________ | | 192.168.1.10 |
LAN IP _____________
192.168.1.1

1. Packet requests comes in to 4.4.4.4 (WAN Port on pfsense) on port 80 from an External client of 5.5.5.5

2. Rewrite External SRC IP 5.5.5.5 to the LAN IP Address of the firewall which is 192.168.1.1

3. Send that request to the Web Server of 192.168.1.10 with the SRC IP of 192.168.1.1 instead of coming from 5.5.5.5

Thanks!

shon · Feb 2, 2012, 3:03 PM

This looks like the iptables command (Reverse NAT) that I would use, but I don't know how to do that in the GUI of pfsense.

iptables -t nat -A PREROUTING -i eth1 -j DNAT -d 4.4.4.4 –to 192.168.1.1

jimp · Feb 7, 2012, 1:51 PM

Switch to manual outbound NAT (Firewall > NAT, outbound tab)
Add a rule for the LAN interface, source of ANY, destination of 192.168.1.10, translation = Interface address.

shon · Mar 6, 2012, 7:34 PM

That worked like a charm!

Thanks!

shon · Mar 13, 2012, 9:06 PM

@shon:

I was able to accomplish this but without having to select the "Manual Outbound NAT rule generation". The rule was good enough to do the job.

Thanks!