NAT (Port Forwarding) and web failover



  • Hi all,
    I am new to pfSense and to this forum as well, so forgive me if I am posting it in wrong place.
    I am using 2.0-RELEASE (amd64)
    This is my network

    I am trying to set up a failover for the web.
    I have 2 problems.

    1. I have created the NAT port forwarding but it doesn't work. If I create a NAT rule to access directly the web server then it works, but it doesn't work for the virtual server.
      The virtual server for the failover is accessible from the VPN but not from internet.
    2. The web-slave is not accessible when I am connected to the VPN of pfSense1 but the load balancer status shows it online. The traffic is not being blocked by any FW.
      Any idea what am I doing wrong/what do i miss to make this work?

    Thnx in advance.



  • Remove nat rules for http as you have configured the load balance for these servers.



  • Hi marcelloc,
    virtual server: 192.168.100.100
    web:192.168.125.101
    web-slave:192.168.129.101
    I have a nat rule, source:wan address https, destination:192.168.100.100
    if i remove that how will it work?



  • skipper,

    I think that load balancing by definition has to use NAT, so creating a NAT rule manually would conflict with the automatically created settings used by load balancing.



  • @skipper:

    if i remove that how will it work?

    The virtual server will listen on wan interface ip.

    If you create a nat, the you will have two services "listening" on the same port/ip

    Create the virtual server and then create a wan rule to allow traffic to it with no nat.



  • i disabled the NAT rule and created 2 rules on the wan interface, first one destination wan address and the second one destination virtual server so i have not blocked package on the FW but still it doesn't work.
    from my vpn connection i can access the virtual server but not from internet so i am a bit confused :S
    do i need to setup something more?



  • Did you changed pfsense gui port and disabled WebGUI redirect to avoid conflict with your http redirect?

    Is 192.168.100.100 your wan address?



  • In your network, is the site-to-site a VPN or a point to point connection? They seem to be in different networks, so you are going to have to make sure that your routing and NAT reflect this.



  • i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
    how do i disable WebGUI redirection?
    192.168.100.100 this is virtual's server ip, my wan address has an internet ip.



  • it's a vpn site-to-site. there is routing between the 2 networks so the web and web-slave can see each other. do i need an additional routing rule?



  • @skipper:

    i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
    how do i disable WebGUI redirection?
    192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

    Create another virtual server with wan ip and it will work.



  • hey marcelloc thnx a lot, it's working!!
    i cannot access the web-slave from internet but i can access it from web's network.
    do i have to create some nat or routing about that?



  • What status you have on loadbalance for the web-slave?

    status -> loadbalancer



  • the status is enable and accessible (green 100%) that's why i don't understand.



  • i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?



  • @skipper:

    i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

    You will need an outbound nat to "masquerade" client internet ip. This way the server can return the package through vpn instead of forwarding it to it's wan



  • thnx for your help marcelloc!!
    how must the outbound nat look?
    these are the vpn IPs
    pfsense1 ip : 10.4.0.1
    pfsense2 ip : 10.4.0.2



  • It's on firewall -> nat -> outbound



  • i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
    here is my outbound nat rule

    Interface webslavelan
    Source      192.168.129.0/24
    Source Port   443
    Destination   10.4.0.0/30
    Destination Port *
    NAT Address *
    NAT Port   443
    Static Port   NO



  • @skipper:

    i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
    here is my outbound nat rule

    Interface webslavelan
    Source       192.168.129.0/24
    Source Port    443
    Destination    10.4.0.0/30
    Destination Port *
    NAT Address *
    NAT Port    443
    Static Port    NO

    change source to any.
    does webslavelan is the outgoing interface to reach 10.4.0.0/30?



  • thnx for your help man!
    this is my network a bit more detailed,
    i have tried to put different interfaces and IPs on the outbound configuration but the traffic goes still to my wan :/
    now i put vpnsitetosite as interface and source any but it doesn't work.
    what should the destination be? is there something else that i need to define? create a new gateway or something like that?




  • Try to go to console and do some package capture to find what interface pfsense is using to send traffic to remote host.



  • the request is going from vpnsitetosite–>webslavelan-->webslave
    and the reply is going from webslave-->webslavelan-->wan
    i need to send it back to vpnsitetosite interface



  • Can you select vpn interface on outgoing nat rule?



  • i can select OpenVPN but not the specific vpn interface.
    do i need to create a virtual IP, a rule to 1:1, or something additional?
    i have tried many combinations for the outbound rule but the http replies are keep going to the wan interface :/



  • What you get when you select openvpn as interface on outbound nat for this server?

    If you can't do it with load balance, consider using a reverse proxy like (varnish,squid-reverse,apache+mod_security)



  • i get the same, nothing changes if i select openvpn as interface.
    i will try to find another solution as it seems that what i am trying to do it's not possible with load balance.
    thnx for your help!


Log in to reply