Bring IPs from LAN to WAN. NAT relevant?

Assassin

Hello folks,

I've got a simple, yet difficult to solve problem.

Network as follows:

Router (10.0.0.1) ______ pfSense WAN (10.0.0.99) |pfSense itself| pfsense LAN IP (10.0.0.101)–---------------Clients 10.0.0.101, 10.0.0.102 etc
|
|______Proxy Server with security Software (10.0.0.100)

(Router, pfSense WAN and Proxy Server on same Switch, Clients an pfSense LAN on another one)

For now, every client communicates to the Proxy server with the pfSense's WAN IP 10.0.0.99. For different filtering rules on the Proxy server I need to "route" the
different client IPs to the proxy (10.0.0.100), so that every client appears to the proxy as single station.

Can I achieve this with NAT rules? Something to do with 1:1 natting? Could s.o. please post a rule, as I don't get it what to set there.

Thanks in advance,

Gunnar

johnpoz

You have the same network on both sides of pfsense? How this going to work? Are you bridging?

Assassin

Hi johnpoz,

no, sorry, it was just a braingame to simplify the task, I thought it woukd make things easier.

I've got a 192.168.0.0/24 net on the LAN side.

After I watched this video http://www.youtube.com/watch?v=5lMRA1ntgz8 I made some virtual IPs togehter with the 1:1 NAT rules and it works
great, for example a Client with LAN address 192.168.0.50 comes out on WAN with 10.0.0.50.

Thanks anyway!

johnpoz

Great you got it worked out - so you nat internally then? Love to ask why? Why would you nat between 2 rfc1918 spaces?

Why don't you setup policy on your proxy for the specific IPs to use whatever policy want vs 1:1 natting them to some other rfc1918 space? Just trying to understand why anyone would go this route?

Thanks.

Assassin

Hi johnpoz,

it's quite simple. It's a boarding school where the kids have their own laptops, so I'm in the need to put a firewall between them and the gateway,
since the proxy itselft is just a software appliance which controls site access and has no routing features itself, since it runs on a simple Windows machine.

So this and the fact that the kids are in their own private network makes it hard to breach security guidelines, like no one is allowed to access
internet unfiltered. And this is why I love pfSense for, it has a solution for everything.

Maybe there's also a better solution, but this came up to me as the most convenient way to control and monitor network flow.

Greetings Gunnar

johnpoz

Yeah thats great, no reason to nat it though.. Now your wanting to do 1:1 for things behind the nat so you can assign them different policies based upon IP, etc??

"a Client with LAN address 192.168.0.50 comes out on WAN with 10.0.0.50. "

Seem to me your just making it more complex with a nat - why not just route your 192.168.0.0/24 segment with pfsense and firewall all you want, etc. Not seeing the reason to nat between to private IP spaces is all.

Putting kids devices on their network segment makes complete sense, and yes I would highly suggest isolation of such devices for all kinds of reasons. I just don't understand why you would nat them, especially if you then want to assign something to specific IPs behind the nat, so you now need to setup specific 1:1s behind etc.

Assassin

You're right, but until now I only thought about the scenario with NAT, because I didn't knew better and did not take the possibility to do it without NATting in account.

Perhaps I will rethink the whole thing, but as for now that everything works great I don't have to bother about it.

But thank again for the hint! :D

Greets Gunnar