NAT (Port Forwarding) and web failover

skipper · Feb 27, 2012, 9:54 PM

hey marcelloc thnx a lot, it's working!!
i cannot access the web-slave from internet but i can access it from web's network.
do i have to create some nat or routing about that?

marcelloc · Feb 27, 2012, 10:39 PM

What status you have on loadbalance for the web-slave?

status -> loadbalancer

skipper · Feb 27, 2012, 10:50 PM

the status is enable and accessible (green 100%) that's why i don't understand.

skipper · Feb 28, 2012, 3:30 PM

i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

marcelloc · Feb 28, 2012, 3:39 PM

@skipper:

i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

You will need an outbound nat to "masquerade" client internet ip. This way the server can return the package through vpn instead of forwarding it to it's wan

skipper · Feb 28, 2012, 3:49 PM

thnx for your help marcelloc!!
how must the outbound nat look?
these are the vpn IPs
pfsense1 ip : 10.4.0.1
pfsense2 ip : 10.4.0.2

marcelloc · Feb 28, 2012, 4:26 PM

It's on firewall -> nat -> outbound

skipper · Feb 28, 2012, 4:40 PM

i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
here is my outbound nat rule

Interface webslavelan
Source 192.168.129.0/24
Source Port 443
Destination 10.4.0.0/30
Destination Port *
NAT Address *
NAT Port 443
Static Port NO

marcelloc · Feb 28, 2012, 4:46 PM

@skipper:

i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
here is my outbound nat rule

Interface webslavelan
Source 192.168.129.0/24
Source Port 443
Destination 10.4.0.0/30
Destination Port *
NAT Address *
NAT Port 443
Static Port NO

change source to any.
does webslavelan is the outgoing interface to reach 10.4.0.0/30?

skipper · Feb 28, 2012, 7:35 PM

thnx for your help man!
this is my network a bit more detailed,
i have tried to put different interfaces and IPs on the outbound configuration but the traffic goes still to my wan :/
now i put vpnsitetosite as interface and source any but it doesn't work.
what should the destination be? is there something else that i need to define? create a new gateway or something like that?

marcelloc · Feb 28, 2012, 9:03 PM

Try to go to console and do some package capture to find what interface pfsense is using to send traffic to remote host.

skipper · Feb 28, 2012, 9:16 PM

the request is going from vpnsitetosite–>webslavelan-->webslave
and the reply is going from webslave-->webslavelan-->wan
i need to send it back to vpnsitetosite interface

marcelloc · Feb 28, 2012, 9:17 PM

Can you select vpn interface on outgoing nat rule?

skipper · Feb 28, 2012, 9:19 PM

i can select OpenVPN but not the specific vpn interface.
do i need to create a virtual IP, a rule to 1:1, or something additional?
i have tried many combinations for the outbound rule but the http replies are keep going to the wan interface :/

marcelloc · Feb 29, 2012, 1:57 PM

What you get when you select openvpn as interface on outbound nat for this server?

If you can't do it with load balance, consider using a reverse proxy like (varnish,squid-reverse,apache+mod_security)

skipper · Feb 29, 2012, 2:07 PM

i get the same, nothing changes if i select openvpn as interface.
i will try to find another solution as it seems that what i am trying to do it's not possible with load balance.
thnx for your help!