NAT reflection from another subnet

georgeman · May 4, 2012, 10:03 PM

Hi! I have quite a complicated setup:

WAN1 WAN2
| |
pfSense1–----------------------------pfSense2
| |
Subnet1 Subnet2

I have manual outbound NAT rules to allow me to switch which WAN is giving access to each subnet. Also, I have a port forward rule on pfSense1, in order to allow access from WAN1 to a server that resides on Subnet2

Now, what I need is to be able to access that server (which is on Subnet2), using the public IP from WAN1, from within Subnet2.
Accesing that server is possible through the WAN2 IP address while on Subnet2 (just a regular NAT reflection), but I can't to work the same with WAN1.
The setup also involves policy routing from Subnet2 to WAN1 subnet (so we can access other servers from the WAN2 subnet internally)

I know this has probably has to do with some addiotional Outbound NAT rule, but I am not able to figure it out.

Any ideas?

Thanks a lot!!

georgeman · May 5, 2012, 3:03 AM

Well, I figured it out ;D

I'll leave it posted here for further reference.

In order for this to work I needed:

A regular port forwarding rule on pfSense1, over the interface that links both boxes, forwarding packages that go to WAN1IP:PORT to the internal IP of my server on the right port (cross subnet routing was already solved and working before all this)
An Outbound NAT rule on pfSense1, over the interface that links both boxes, with the "Source" specified to Subnet2

As you can see, the outbound rule makes everything that "bounces back" through that interface to become NAT'ed, and thus, should enable the ability to access any of the port forwards on the other box considering the right port forwarding rule was added. The routing is correctly configured (I believe!) so no other traffic should bounce back and become NAT'ed unnecessarily.

Why does it always look so simple and straight-forward once you figured it out?? ;)

Cheers!