NAT and routing

[BJXYZ]

Hi,

i have one WAN Interface with pppoe und one WAN with a static Adress. I also have some internal interfaces for DMZ, LAN, etc. For some server in the DMZ I added a virtual IP and a 1:1 NAT. Everything works great. But I want to setup a new internal Interface which should be routed (with Firewall rules). At the static interface this is no problem, i could use a bridge. But what about my pppoe connection? The connection get a static ip from the provider and the provider routes some ips trough this connection (2x /27 subnet). Is it possible to build a bridge or route some ips to another internal interface? The firewall has enough free ports.

Thanks.

Greeting

BJ

[podilarius]

well you would not use a internet routable unless it is routed by your ISPs to one of the WAN addresses. Since you are already using NAT, I would setup 1:1 NAT with the new IP in a different subnet on a new interface.

[Azannah]

I logged on today to ask the same basic question as BJXYZ. If BJXYZ's issue is anything like mine, 1:1 NAT won't work for everything.

I'm replacing a ZyWall configured to use 3 subnets. One address from subnet A is configured on my WAN. I use this address for 1:n NAT. Subnets B and C are routed through the WAN address (the one from subnet A). I use subnet B for various 1:1 NAT mappings. Subnet C is routed to my DMZ where I host services that don't play well with NAT. Now I'm looking at replacing the ZyWall with pfSense.

Is this configuration possible with pfSense?

BJXYZ,

You indicate you've used a bridge on one of your WANs. Following the trail of documentation about bridges (starting here: http://doc.pfsense.org/index.php/What_is_a_bridged_interface_and_how_would_one_be_used%3F) seems to indicate you'll run into a problem when your LAN clients try to access devices on the bridged interface (assuming your LAN clients use NAT). Have you noticed any such problems?

Regards everyone!

[dhatz]

You could enable Manual Outbound NAT, delete any auto-generated rules for the DMZ interface and just route subnet C.

[Azannah]

Thanks Dhatz,

That's what I was thinking too. I guess it's off to the test lab!