Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Nat on firewall interface to other internal host?

    NAT
    3
    3
    1328
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      symgryph last edited by

      I know this is kind of funny, but I would like to nat an ip address (my firewalls lan interface in this case) to another internal host on my lan. The nat rule would look something like:

      my pc –--  firewall:5555 ---- internal host:22

      So I would like to take traffic destined for the lan interface of the firewall on port 5555 and redirect it to host x.x.x.x on port 22. I tried using nat rules, and saw packets going out and being natted correctly, but never saw traffic on destination machine. Is there a problem with same interface nat?

      Thomas

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        For what possible reason would you want or need this?

        Just go directly to internal host:22, at a loss to why you would want to hit 5555 an any internal IP on your lan just to get directed to some other internal lan IP on a different port?

        Talk about violation of the KISS principle ;)

        1 Reply Last reply Reply Quote 0
        • K
          kathampy last edited by

          This can only work if the internal host is on a different subnet than the rest of the LAN, such as if your LAN is 10.0.0.0/8 and you want to access a randomly plugged-in device with a default IP address of 192.168.1.1/24.

          Create a Virtual IP address alias of 192.168.1.254/24 (254 is probably unused and won't conflict with the plugged-in device). Then create a manual NAT rule for the LAN interface from your LAN subnet to 192.168.1.0/24. Make sure you also have a firewall rule on the LAN interface that allows traffic from anywhere to 192.168.1.0/24.

          Now you can directly access the device from any of your LAN clients by simply typing 192.168.1.1. You can also optionally create a port forward to access it via firewall:port.

          Note that if the device has RIP enabled on its LAN interface, and you have RIP enabled on pfSense, you don't need to create the NAT rule. Simply plugging in the device will automatically make it accessibe on your LAN via 192.168.1.1 if pfSense has a virtual IP address in the same subnet as the device.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy