Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multi wan interface groups not available for NAT port forwarding

    Scheduled Pinned Locked Moved 2.1 Snapshot Feedback and Problems - RETIRED
    5 Posts 3 Posters 3.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X
      xbipin
      last edited by

      i just noticed that if i use 2 WAN connections in a fail over manner, i can create interface groups for them but they dont appear under NAT port forward so cant create port forwarding to both WANs at once, still need to add per interface, is this be design or its a bug?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        Interface groups do not work well with WANs, so that hasn't been looked into.

        Rules on a group tab do not get reply-to, so the traffic will not travel back via the WAN it entered. It will always leave by the default gateway.

        The only place that they do work is in a failover-only scenario with BGP where the default route does actually change from one WAN to the other and only one should work at a time.

        If you want them to work independently, then you can't use a group.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • X
          xbipin
          last edited by

          probably a GUI solution to this could be allowing to to create NAT entries using interface group but actually creating entries in the firewall rules per interface who are in the group, this way u dont need to have so many entries under NAT for each interface

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            yes we have considered that but it would be a major change to the underlying code. It isn't quite that simple. Interface group support is built into the OS and we simply build off of that.

            I believe there is already an existing ticket in redmine for it somewhere. It may change in 2.2, it may not.

            Floating rules have the same limitation if they attach to multiple interfaces.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • M
              mpaigni
              last edited by

              @xbipin:

              i just noticed that if i use 2 WAN connections in a fail over manner, i can create interface groups for them but they dont appear under NAT port forward so cant create port forwarding to both WANs at once, still need to add per interface, is this be design or its a bug?

              Hello,

              How do you use NAT in multi WAN scenario.
              What I want: in case of a failure of one WAN,  the NATing will have to change according to which WAN connection i up.
              otherwise the packets leaving the router to the wrong ISP will not be able to be routed by the relevant ISP(wrong nat).

              How do you create port forwarding rules from the same LAN private ip to  different wan public ips?
              For example: I have 2 WANs with 16 public ips each
                                                        In my WAN1 connection I let my LAN users go out from WAN1_StaticIP_10th
                                                      and in my WAN2 connection let the LAN users NAT to WAN2_StaticIP_8th
                                        I use manual outbound rules for that. I use some 1:1 rules for my webservers in DMZ.
                                        Up to here everything works fine. I cannot figure out how to use manual outbound NAT with multiWAN.

              1)  You say "port forwarding to both WANs at once".
                                Do you refer  to NAT-forwarding or manual advanced NAT-oubound rules?

              Are these 2 manual NAT possible?
                                        source                  dest          dest port                NAT address                     
                                          LAN                          *                    80            WAN1_StaticIP_10th         
                                          LAN                          *                    80              WAN2_StaticIP_8th

              Will the above together with a
                                      MultiWAN setup (group in TIER1 categories and firewall rule using the group as gateway)
                                      work and guarantee that after  failover I will be able to NAT?

              2)  What about a Email server in my DMZ (static NAT)? May I have 2 lines for every LAN address in NAT1:1rules  (similar to the above)?
                              I have requested to add 2 addresses in the MX records with the same priority (one the WAN1_staticIP_6th + WAN2_staticIP9th).

              If (1) and (2) cannot be done should I use second IPs in LAN and DMZ hosts and have
              one  for the WAN1 and one for the WAN2?

              Sorry in advance for being too verbose or too idiot….
              Michail

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.