Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT based on soruce IP

    Scheduled Pinned Locked Moved NAT
    2 Posts 2 Posters 714 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      malakak
      last edited by

      Hi Guys,

      This is the first time I'm writing on this forum.

      I'm a big fan of pfsense and we have very complex pfsense set-up working very well, as a new requirement we need to re-direct traffic (NAT) based on the Source IP address.

      Ex :-

      RULE 01 - Users coming from USA -> (IP-A) -> NAT -> WEB_SRV_01 (same public IP/URL/Same port)
      RULE 02 - Users coming from AU  -> (IP-A) -> NAT -> WEB_SRV_02 (same public IP/URL/Same port)
      RULE 03 - Users coming from ANY_OTHER -> (IP-A) -> NAT -> WEB_SRV_03 (same public IP/URL/Same port)

      What we relay need is when people accessing our website from different countries, direct them to different web sites.

      I have used pfblocker to sort out the country IP's using Aliases, but NAT it's not working properly.

      EX failure :-

      if traffic is coming from USA

      It's redirecting traffic USA to WEB_SRV_01 one as well as WEB_SRV_03. (hitting both RULE 01 and RULE 03 round-robin)

      I thought NAT are working same as firewall rules from top -> bottom (but looks like no)

      if I use negative source (!USA) on RULE_03, traffic coming from USA re-direct to WEB_SRV_01 once and getting failed on the other time, coz it's trying to use the RULE 03

      Hope you guys can share some light on this and get me in to the correct path. I'm not sure what i have to do get this working.

      Thanks in advance.

      Regards,
      Malaka

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        Sounds like you're doing things right. The scenario you described will work fine. I think the most likely issue is pfblocker's data is something like 2 years old at this point, the package maintainers stopped updating the list a couple years ago when countryipblocks.net discontinued their free lists. Use a better data source (like a paid subscription to countryipblocks.net) and I suspect it'll probably work.

        We'll be putting out a better alternative in the not too distant future for country IP lists, that's something you'll want to keep an eye out for. (subscribe to announcements list @ lists.pfsense.org if you haven't already)

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.