Adding a NAT 1:1 mapping to ISP public IP stops internet access

miles267 · Nov 8, 2012, 6:02 PM

Am running a Windows Server 2012 box behind pfsense 2.0.1. The server is serving as both my DHCP and DNS server for my home LAN. There are no issues until I attempt to add a NAT 1:1 entry into my pfsense box.

I've setup a Virtual IP for my the static IP my ISP has provided. Once I add a NAT > 1:1 mapping from one of my ISP's static public IPs to my windows server box of 192.168.0.5, the 192.168.0.5 is losing inbound and outbound internet access.

If I then reboot pfsense, it restores internet connectivity for 192.168.0.5 for a few minutes but quickly disconnects until rebooted again. Whereas, if I then remove the 1:1 mapping and reboot, connectivity is once again restored.

Ultimately, I am wanting to register one of my static ISP public IPs to my 192.168.0.5 so that I can RDP into the server from the internet by way of it's ISP public IP.

The pfsense DHCP server has been disabled on my pfsense LAN interface since I'm now using the windows server's DNS functionality as my home DNS server.

I noticed this in the NAT 1:1 web UI, but I don't quite understand how to go about it. Should I be doing this differently?

podilarius · Nov 8, 2012, 11:03 PM

If you are the same person from another post, you are using comcast dhcp for your WAN address. I doesn't really work with 1:1. You seem to have static, so if you are using comcast business, set the WAN to static and add the IP address from DHCP. The gateway also. So it is best to write all that down first. Once you have set the static IP, then go to Firewall -> Virtual IP and setup the IP address you want. I would choose IP alias type. Once you have that set, then you can go back and setup the 1:1 and any inbound rules you like.

*** Note that once you set the WAN IP the modem will take a second to recognize the config change and switch to bridge mode. Should not take more that 5 minutes.

miles267 · Nov 9, 2012, 2:48 AM

I have Cox business with 5 static IPs: 24.248.x.1, 24.248.x.2, 24.248.x.3. I am able to connect to the internet fine as long as I set the pfsense WAN interface to DHCP. If so, it receives a 70.x.x.16 IP. It receives a 70.x.x.1 gateway.

Spoke to Cox support tonight and they told me to set my WAN to static and use 24.248.x.1 with a subnet mask of 255.255.255.0 and a specific gateway IP. Despite plugging this info into pfsense:

1.) it doesn't accept 24.248.x.1 as the static WAN IP. It insists on returning 24.248.x.3.
2.) although I entered the WAN IP as 24.248.x.1 /24 (implying 255.255.255.0 subnet mask), the pfsense interfaces page reports 255.255.255.255
3.) the static gateway IP I entered says offline

Beyond frustrating. #1 and #2 almost seems like bugs in pfsense though it would appear others haven't had these issues.

johnpoz · Nov 9, 2012, 12:45 PM

How many threads you going to start about the same subject?

"told me to set my WAN to static "

Like I said in the other threads ;)

Now your saying there is a bug in pfsense that you can not set static wan ip to .1?? Come on dude does that make sense? Did you REMOVE your vips?? pfsense is not going to let you set x.x.x.1 if you already have x.x.x.1 set in a VIP now is it.

miles267 · Nov 9, 2012, 2:03 PM

I apologize johnpoz for the confusion. what started out as one thread, morphed into a few topics. I was simply trying to put a topic in the correct forum.

Yes, my ISP provided a series of static IPs and a gateway and told me to:

1.) use my first available static IP (call it 24.248.x.100) for my router. however when I do this, it returns a different static IP from my static range like 24.248.x.105 instead. It doesn't accept the one they told me to use. .100 wouldn't be in use by any other device.

2.) the WAN subnet they provided is 255.255.255.0. However when I enter my static IP /24, pfsense reports a netmask of 255.255.255.255.

3.) when I enter the gateway into pfsense (24.248.x.1), it says Gathering data and then "offline" (in red)

Finally when I set my pfsense WAN interface back to DHCP, it obtains a 70.x.x.x address and a dynamic gateway 70.x.x.1 and works perfectly.

Thanks for your patience and guidance.

johnpoz · Nov 9, 2012, 2:38 PM

Well without pictures of what your doing - just guessing. I have no idea where your trying to set this stuff??

So - for quick test, I just set my wan to static. And then looked it its status, looks like it take .1 to me, and shows the correct mask.

So lets see some screen shots of what your saying is happening. Because it just makes NO sense!

edit: So in one post you state it wont let you set .1 as interface address. Then in next post your trying to set that as your gateway?? WTF dude?

Again did you clear all your vips? Did you clear any nats you had setup? How about you just start over with a clean install and do what your isp told you to do this time at first. If setting static does not work, then contact them. But its just not going to work using dhcp as wan and then trying to setup statics vips.

miles267 · Nov 9, 2012, 2:38 PM

OK. Will grab some screens as you've suggested. Also, are you running the latest 2.1? Am currently on 2.0.1-release. Would there be any merit it upgrading to 2.1 first?

johnpoz · Nov 9, 2012, 4:12 PM

I can fire up 2.01 if you want - what your saying makes no sense!

I would do a clean install of 2.1 if me - it is more than stable enough for use in all but the most critical of setups.

edit:
Also what makes no sense is that they would give you 5 IPs, but give you a /24 mask? Very strange - normally they would give you a block, say /29 for example

miles267 · Nov 9, 2012, 7:07 PM

After contacting my ISP, it turns out there was an issue on their end. Seems the static IPs they issued me weren't going to ever work. Nevertheless they've since issued me an entirely new block of IPs with a new gateway and subnet mask. Will try to reconfig 2.0.1 w/ these and do a clean install of 2.1beta if that fails to work.

IPs: 184.185.x.x
GW: 184.185.x.225
Subnet mask: 255.255.255.224
DNS: no changes

johnpoz · Nov 9, 2012, 7:18 PM

well a /27 is still a block of 30 addresses and they say only get 5?

I would suggest you reboot your modem as well when you change your wan to static.

Let us know how it turns out.

miles267 · Nov 9, 2012, 7:24 PM

@johnpoz:

well a /27 is still a block of 30 addresses and they say only get 5?

I would suggest you reboot your modem as well when you change your wan to static.

Let us know how it turns out.

Will do. Yes, there's a support portal I can login to for my ISP that lists out my assigned static IPs, GW, Netmask, DN1 and DNS2. Will enter as static IP /27 as suggested. Perhaps they create a block of 30 IPs but divide them up to subscribers in sets of 5, etc? Sure hope this works.

ealbin · Nov 11, 2012, 9:10 PM

"Also what makes no sense is that they would give you 5 IPs, but give you a /24 mask? Very strange - normally they would give you a block, say /29 for example"

I have Comcast business class, block of 5, mine is as you say /29, which of coarse translates into a subnet of 255.255.255.248.

Although in many routes if the subnet is put in incorrectly, that is figured out. When the info is put in CIDR notation, then not sure it can sort out a mistake.

Pfsense uses CIDR.

miles267 · Nov 11, 2012, 9:24 PM

Turns out they had given me a set of static IPs that were invalid. So of course the netmask and gateway didn't correspond with them either. When I attempted to plug them into my pfsense WAN interface, I didn't have any connectivity. Since they've reissued a new, valid set of IPs that are entirely different than the original set, it's no wonder I couldnt connect.

What a relief. Looking back I would've never connected. And it wasn't until I assisted on a new block of IPs that it would've ever worked.