Incoming TCP traffic dies after 1:1 NAT??

  • Hi guys,

    I have PFSense v1.2-RC3 set up to do 1:1 NAT for my assigned range of 64 external IPs.
    I started NATting 2 servers with following setup:


    • WAN: Type static, IP, gateway
    • LAN: Bridge with none, IP
    • No OPT1

    Virtual IPs:

    • Proxy ARP, on WAN, Single address,
    • Proxy ARP, on WAN, Single address,

    1:1 NAT:

    • on WAN, external, internal
    • on WAN, external, internal


    • on WAN,  *  *  * * * *    Pass anything in (just for tests)
    • on LAN,  * LAN net * * * *    Default LAN -> any


    • both set up with as gateway

    Both servers can be accessed no problem from the internal subnet.
    However when I browse to either of the external IPs no response comes back.
    I first thought 1:1 NAT did not work but it does. The rule gets triggered according to the log and when I tcpdump the server connection I get:

    18:40:42.279005 IP (tos 0x0, ttl 119, id 51126, offset 0, flags [DF], proto: TCP (6), length: 48) > S, cksum 0x0f84 (correct), 3325806490:3325806490(0) win 65535 <mss 1452,nop,nop,sackok="">but…. nothing comes back.

    When I access the servers through their external interfaces (directly linked to the internet, just testing...) I get:
    18:32:34.608860 IP (tos 0x0, ttl 120, id 50184, offset 0, flags [DF], proto: TCP (6), length: 566) > P 22764:23290(526) ack 4000 win 64512

    and the response:
    18:32:34.609263 IP (tos 0x0, ttl  64, id 368, offset 0, flags [DF], proto: TCP (6), length: 133) > P 4000:4093(93) ack 23290 win 53606

    So no problems there. Access from the local subnet works as well.

    I read through all 1:1 NAT related posts but cannot find any reference to this problem.
    Upgrade to RC3 has not helped. Neither has redoing the config, reboots etc.

    I would be greatful for any ideas about how to solve this… I'm kind of stuck for over a week now.</mss>

  • Just a dumb question but in the "Interfaces -> Wan" settings are the "Block private networks" and / or "Block bogon networks" check-boxes checked??? If so try un-checking them and see if it helps…


Log in to reply