• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

NAT (Port Forwarding) and web failover

Scheduled Pinned Locked Moved NAT
27 Posts 4 Posters 9.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    skipper
    last edited by Feb 28, 2012, 1:45 PM Feb 27, 2012, 10:31 AM

    Hi all,
    I am new to pfSense and to this forum as well, so forgive me if I am posting it in wrong place.
    I am using 2.0-RELEASE (amd64)
    This is my network

    I am trying to set up a failover for the web.
    I have 2 problems.

    1. I have created the NAT port forwarding but it doesn't work. If I create a NAT rule to access directly the web server then it works, but it doesn't work for the virtual server.
      The virtual server for the failover is accessible from the VPN but not from internet.
    2. The web-slave is not accessible when I am connected to the VPN of pfSense1 but the load balancer status shows it online. The traffic is not being blocked by any FW.
      Any idea what am I doing wrong/what do i miss to make this work?

    Thnx in advance.
    net.jpg
    net.jpg_thumb

    1 Reply Last reply Reply Quote 0
    • M
      marcelloc
      last edited by Feb 27, 2012, 10:54 AM

      Remove nat rules for http as you have configured the load balance for these servers.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • S
        skipper
        last edited by Feb 27, 2012, 11:07 AM

        Hi marcelloc,
        virtual server: 192.168.100.100
        web:192.168.125.101
        web-slave:192.168.129.101
        I have a nat rule, source:wan address https, destination:192.168.100.100
        if i remove that how will it work?

        1 Reply Last reply Reply Quote 0
        • C
          cpk
          last edited by Feb 27, 2012, 2:46 PM

          skipper,

          I think that load balancing by definition has to use NAT, so creating a NAT rule manually would conflict with the automatically created settings used by load balancing.

          1 Reply Last reply Reply Quote 0
          • M
            marcelloc
            last edited by Feb 27, 2012, 3:01 PM Feb 27, 2012, 2:58 PM

            @skipper:

            if i remove that how will it work?

            The virtual server will listen on wan interface ip.

            If you create a nat, the you will have two services "listening" on the same port/ip

            Create the virtual server and then create a wan rule to allow traffic to it with no nat.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • S
              skipper
              last edited by Feb 27, 2012, 3:10 PM

              i disabled the NAT rule and created 2 rules on the wan interface, first one destination wan address and the second one destination virtual server so i have not blocked package on the FW but still it doesn't work.
              from my vpn connection i can access the virtual server but not from internet so i am a bit confused :S
              do i need to setup something more?

              1 Reply Last reply Reply Quote 0
              • M
                marcelloc
                last edited by Feb 27, 2012, 3:15 PM

                Did you changed pfsense gui port and disabled WebGUI redirect to avoid conflict with your http redirect?

                Is 192.168.100.100 your wan address?

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • P
                  podilarius
                  last edited by Feb 27, 2012, 3:18 PM

                  In your network, is the site-to-site a VPN or a point to point connection? They seem to be in different networks, so you are going to have to make sure that your routing and NAT reflect this.

                  1 Reply Last reply Reply Quote 0
                  • S
                    skipper
                    last edited by Feb 27, 2012, 3:27 PM

                    i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
                    how do i disable WebGUI redirection?
                    192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

                    1 Reply Last reply Reply Quote 0
                    • S
                      skipper
                      last edited by Feb 27, 2012, 3:30 PM

                      it's a vpn site-to-site. there is routing between the 2 networks so the web and web-slave can see each other. do i need an additional routing rule?

                      1 Reply Last reply Reply Quote 0
                      • M
                        marcelloc
                        last edited by Feb 27, 2012, 4:42 PM

                        @skipper:

                        i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
                        how do i disable WebGUI redirection?
                        192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

                        Create another virtual server with wan ip and it will work.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • S
                          skipper
                          last edited by Feb 27, 2012, 9:54 PM

                          hey marcelloc thnx a lot, it's working!!
                          i cannot access the web-slave from internet but i can access it from web's network.
                          do i have to create some nat or routing about that?

                          1 Reply Last reply Reply Quote 0
                          • M
                            marcelloc
                            last edited by Feb 27, 2012, 10:39 PM

                            What status you have on loadbalance for the web-slave?

                            status -> loadbalancer

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • S
                              skipper
                              last edited by Feb 27, 2012, 10:50 PM

                              the status is enable and accessible (green 100%) that's why i don't understand.

                              1 Reply Last reply Reply Quote 0
                              • S
                                skipper
                                last edited by Feb 28, 2012, 3:30 PM

                                i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

                                1 Reply Last reply Reply Quote 0
                                • M
                                  marcelloc
                                  last edited by Feb 28, 2012, 3:39 PM

                                  @skipper:

                                  i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

                                  You will need an outbound nat to "masquerade" client internet ip. This way the server can return the package through vpn instead of forwarding it to it's wan

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    skipper
                                    last edited by Feb 28, 2012, 3:49 PM

                                    thnx for your help marcelloc!!
                                    how must the outbound nat look?
                                    these are the vpn IPs
                                    pfsense1 ip : 10.4.0.1
                                    pfsense2 ip : 10.4.0.2

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marcelloc
                                      last edited by Feb 28, 2012, 4:26 PM

                                      It's on firewall -> nat -> outbound

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        skipper
                                        last edited by Feb 28, 2012, 4:40 PM

                                        i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
                                        here is my outbound nat rule

                                        Interface webslavelan
                                        Source      192.168.129.0/24
                                        Source Port   443
                                        Destination   10.4.0.0/30
                                        Destination Port *
                                        NAT Address *
                                        NAT Port   443
                                        Static Port   NO

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          marcelloc
                                          last edited by Feb 28, 2012, 4:46 PM

                                          @skipper:

                                          i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
                                          here is my outbound nat rule

                                          Interface webslavelan
                                          Source       192.168.129.0/24
                                          Source Port    443
                                          Destination    10.4.0.0/30
                                          Destination Port *
                                          NAT Address *
                                          NAT Port    443
                                          Static Port    NO

                                          change source to any.
                                          does webslavelan is the outgoing interface to reach 10.4.0.0/30?

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          20 out of 27
                                          • First post
                                            20/27
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received