NAT 1:1 and Firewall rules order: How to apply a rule BEFORE NAT 1:1 translation

  • My config

    Two hosts 1&2, host 2 located on LAN has a virtual IP in the DMZ. NAT 1:1 enabled between IP:A and IP:C

    My goal: to block traffic IP:B -> IP:C, but allow IP:B -> IP:A

    I beleive that the NAT 1:1 translation is applied BEFORE the firewall rules. So in fact the rule "allow IP:B -> IP:A" has no effect AND the rule "block IP:B -> IP:C" also blocks traffic IP:B -> IP:A.

    How can we workaround this ?

    PfSense–DMZ--  VirtualIP(IP:A), Host 1 (IP:B)
    Host2 (IP:C)


Log in to reply