VIP - Global IP to a host? I am confused…



  • I have tried to create VIP's and ranges of VIPs and mapping these to clients on LAN using 1:1 mapping.

    But… I would like to route one of the global IP's (a VIP) directly to the client on LAN. Or instruct the client to setup the client router with IP-info for the VIP.

    Is that possible?

    Say my pfsense IP is 11.11.11.229 /30
    and I get subnet 22.22.22.104 /29 as a VIP
    LAN could be: 192.168.1.1 /24

    How can let a client connect to the internet with IP 22.22.22.105 from the VIP range?



  • Manual outbound nat or 1:1 NAT is your answer. I personally use MON, because i have 3 subnets to cover with 5 public ip's



  • Thanks for your answer.

    If I get this right 1:1 is not the solution:

    • Using 1:1 NAT the client on LAN will still have the a local IP

    • Incoming trafic to the VIP will go to the client

    • When testing own IP the "global IP" will just be the WAN address for the LAN and not the VIP, correct?

    I would like to give a "real" global IP to a user like I get a global IP from my ISP. Is that possible with pfsense?
    I have lets say 100 users and 5 global IP's. Lets say I use 1 IP for the pfsense and let 98 users be on the LAN. Then the last 2 users would like each there global IP too. Can this be done in other ways than 1:1 mapping? I have spare interfaces on the pfsense box



  • You can route public ip's inside pfsense, it's doable yes, but how I don't know(haven't done that).

    @Tillebeck:

    • Using 1:1 NAT the client on LAN will still have the a local IP

    Yes, it's just mapping that one client always have correct/same public ip
    @Tillebeck:

    • Incoming trafic to the VIP will go to the client

    Yes you can do it that way
    @Tillebeck:

    • When testing own IP the "global IP" will just be the WAN address for the LAN and not the VIP, correct?

    Whant to share your idea over here? You can use VIP or hardware ip with LAN

    @Tillebeck:

    I would like to give a "real" global IP to a user like I get a global IP from my ISP. Is that possible with pfsense?
    I have lets say 100 users and 5 global IP's. Lets say I use 1 IP for the pfsense and let 98 users be on the LAN. Then the last 2 users would like each there global IP too. Can this be done in other ways than 1:1 mapping? I have spare interfaces on the pfsense box

    Like I said earlier, you can use 1:1 or MON to achieve this. With MON you can also use that ip from different machine.
    Like public ip: xx.xx.xx.xx is having www-server @ 192.168.12.3 and e-mail server @ 192.168.13.99 and both of those uses same public ip-address



  • Just a short update. VIP or 1:1 NAT mapping works just fine.

    Create the virtual IP
    Create a 1:1 NAT mapping (VIP to LAN IP)
    Create a firewall rule allowing traffic to the VIP

    Now the LAN client will see the VIP when testing own static IP and not the IP that all normal LAN users share.

    Perfect.

    What MON is I do not know. I will look into it.
    Thanks a lot



  • MON = Manual Outbound NAT



  • Ahh… thanks. That was acticated too due to open op for VOIP from several clients to same external gateway. I read that was needed to have two way sound.


Log in to reply