Basic out-going NAT isn't working



  • Firewall is routing the packets like it's a router. Capturing the packets on the WAN interface shows that the source IP remains unchanged (private IP).

    I've triple checked that setting on Setup>>Firewall/NAT>>Disable all packet filtering isn't on.
    Outbound NAT rules are set to automatic, but even configuring it to Manually and adding a default rule doesn't do anything.

    I haven't seen anything useful in the system logs.

    A "pfctl -s state" command returns an empty table.

    I upgraded it from 2.1.4 to 2.1.5 thinking maybe something behind the scenes was causing problems but whatever is going on must be in the configuration file as the issue persists.

    How does pfSense determine which interfaces require natting? Does it have something to do with an interface having a default gateway?

    Any other things I can check for via the console?

    I heard that pfblocker can cause problems. I did have it installed but removed it to rule it out.

    Besides rebuilding the firewall I'm out of ideas.

    Help me Obi Wan Kenobi, you're my only hope!


  • Banned

    :D

    Have you defined a gateeway in routing menu?



  • The WAN interface is configured as DHCP. The gateway is automatically and assigned due to that. looking at the route table the default gateway seems just fine.


  • Banned

    And you have set DNS in DNS settings for FW ?



  • hmm, I want to say yes, but I also know that they weren't ideal. Let me have a look at that.

    Edit: The "Allow DNS server list to be overridden by DHCP/PPP on WAN" is checked and the DNS servers are listed correctly on the dashboard.


  • Rebel Alliance Global Moderator

    So lets see this sniff where your saying IP is not being changed.  Change back to auto on your outbound nat.

    what does your state table look like - your not seeing a state that has been natted?




  • Same Problem here with v. 2.1.5  :/

    As soon as I make any change under 2.1.5 on the outbound NAT, NAT doesn't work anymore.

    A return to automatic also does not work anymore

    I have downgraded to 2.1.4 and it works again.

    I have already opened a thread due to the problem in the German section. (sry for duple Post)


  • Rebel Alliance Global Moderator

    So as I asked the OP, lets see your state stable showing these unchanged IPs and lets see your nat table.  There rarely is a reason to use manual if you ask me.  What did you think you required manual natting outbound for?



  • I use manual NAT for Multi-WAN and a OVPN Interface.


  • Rebel Alliance Global Moderator

    So ok, lets see these states where your not changing the outbound IP and your outbound nat rules..  Without some info to work from, its just PEBKAC sorry ;)

    "NAT doesn't work anymore."

    Do you take your car to the mech and just say it doesn't work anymore ;)  Do you go to the doc and when he asks whats wrong - "I'm Sick"



  • Sorry for the poor information. My english is cruel.

    It is very complicated for me to detail to write in english.

    It is easier for me if you tell me by what and how I look and I'll tell you what comes out, ok ?

    One in advance … the command "pfctl -s state" brings an empty result, the firewall-log is empty


  • Rebel Alliance Global Moderator

    so this is empty?

    [2.1.5-RELEASE][root@pfsense.local.lan]/root(3): pfctl -s state
    vmx3f0 ipv6 24.13.xx.xx -> 184.105.253.14      MULTIPLE:MULTIPLE
    vmx3f0 ipv6-icmp ff02::1[192] <- fe80::201:5cff:fe66:4046      NO_TRAFFIC:NO_TRAFFIC
    gif0 ipv6-icmp 2001:470:xxx:9c4::2[51329] -> 2001:470:xxx:9c4::1      NO_TRAFFIC:NO_TRAFFIC
    vmx3f2 tcp 17.110.224.14:443 <- 192.168.2.230:56975      ESTABLISHED:ESTABLISHED
    vmx3f0 tcp 192.168.2.230:56975 -> 24.13.xx.xx:1609 -> 17.110.224.14:443      ESTABLISHED:ESTABLISHED
    vmx3f0 ipv6-icmp ff02::1 <- fe80::201:5cff:fe66:4046      NO_TRAFFIC:NO_TRAFFIC
    vmx3f1 tcp 70.37.56.25:443 <- 192.168.1.100:26456      ESTABLISHED:ESTABLISHED
    <snipped rest="" of="" output="">Then you got NOTHING going through your pfsense if you have no STATES!!  Did you turn off nat and firewalling and just using it as a router?</snipped>



  • what can I say …  :-\

    /root(5): pfctl -s state
    /root(6):





  • Rebel Alliance Global Moderator

    Is traffic flowing through the firewall?  Without states there is either no traffic or something really wrong..  I would would do a clean install to be honest.



  • @johnpoz:

    Is traffic flowing through the firewall?

    No, it work only the services, are directly connected on the WAN interface, such as squid, ipsec, ovpn etc…

    @johnpoz:

    Without states there is either no traffic or something really wrong..

    Yes i know :D

    @johnpoz:

    I would would do a clean install to be honest.

    Thats the Problem
    It is a new clean install. I have reinstalled the latest version of pfSense (2.1.5 live-install x64), once on an APU and once on an  NF9D-2550 board… both the same result.
    As soon as I set on manual NAT and make a restart, NAT doesn't work anymore.

    I have now the v2.1.4 installed on my APU, and there it works with manual NAT. I don't know why ?!


  • Rebel Alliance Global Moderator

    well seems your doing the nats wrong..  lets see these nats your doing.

    so it works if you have auto nats out of the box on a clean install?



  • If I do a clean install, Auto NAT works.
    Because, when I switch from Auto-NAT to manual NAT and let the auto settings, add a manual rule and make a restart, has NAT stopped working.

    2.1.4 everything runs without any problems, but under 2.1.5 with the same mappings, NAT stops (after reboot)

    By the way, i have an Alix with 2.1.5 nano-bsd image, there manual NAT runs without problems  :o

    Here a screenshot of a mapping without Multiwan.



  • Rebel Alliance Global Moderator

    So its working with the auto, even switched to manual.. But when "add a manual rule and make a restart, has NAT stopped working."

    So what are you adding - clearly this is what is breaking it.



  • To me this outbound NAT looks strange.  I don't see how it could work well.  I'd expect everything to exit over wan_kdg with these setting.



  • ???

    Guys, i have only to add one rule, the system itself has created all other rules ?!

    What should be wrong?


  • Rebel Alliance Global Moderator

    Why do you have same source network on 2 different interfaces? 172.20/16  And then your openvpn network overlaps with that?



  • The Ovpn interface (HideMyAss) can be seen as a WAN interface and the LAN Device going depending on the Firewall Rule either over WAN_KDG or Hidemyass



  • johnpoz  - Thats my question.  Its possible my understanding of outbound NAT is broken.
    But to me it seems this set of rules wont work well.



  • @kejianshi:

    johnpoz  - Thats my question.  Its possible my understanding of outbound NAT is broken.
    But to me it seems this set of rules wont work well.

    They will not work.

    You have 2 rules passing traffic on both WAN_KDG and HYDEMYASS from 172.20.0.0/16 and having the default gateway. The first condition matching the rule will be processed, it means that the one on HYDEMYASS will never be processed.

    If my understanding of Outbound NAT is correct.


  • Banned

    It is. First come, first served.





  • Yes - You can do it with a firewall rule.  Those are also first come first served.

    I wouldn't try doing it in two places though.  Pick one.



  • So I do not know what you want.

    "DUAL" NAT works at the same time. Tested in 2.1.4

    psctl -s state | grep 172.20.111.13
    ovpnc5 icmp 172.20.111.13:1 -> 10.200.1.4:43502 -> 8.8.4.4      0:0
    re1 icmp 172.20.111.13:1 -> 92.99.22.149:61907 -> 8.8.8.8      0:0


  • Netgate

    I have all my NAT here at home set up the same way.  Using a failover gateway group of WAN (cable) and DSL.  Works perfectly (2.1.5).  OP should be able to send outbound traffic to either gateway using policy routing and it should catch the correct NAT rule.

    rubinho what are the firewall rules and gateways / gateway groups set up like?



  • At the moment i have no failover WAN , only one gateway rule for a separate proxy that goes over VPN (HideMyAss).

    I must first take my Voipserver running before I plug in my second WAN into pfsense