PfSense 2.2 - MultiWan - NAT

[nxT]

Hi guys!

I have setup pfSense 2.2 in Promox VM100 with Virtio Driver.

Created Linux Bridge vmbr0 with eth0 in promox and bridge net0, net1, net2 with vmbr0 in pfsense vm

In pfSense VM
Assigned WAN1 (net0) - XXX.XXX.175.203
Assigned LAN (net1) - 192.168.100.1
Assigned WAN2 (net2) - XXX.XXX.162.220

Created Gateway Groups
WAN 1 : Tier 1
WAN 2 : Tier 1

Created firewall rules to support these group

Any client PC can browse and get combined gateway speed fine. FreeNAS also working fine in VM101 in Proxmox

But I cannot make NAT working at all and cannot connect to any internal box with NAT from Public IP with ports. If I enable HTTPS (443) in WAN Firewall Rules I can see the pfSense login page but the NAT forwarding not working at all.

https://XXX.XXX.162.220:8006 -> 192.168.100.2:8006

I also checked with external services and my PORTS are not blocked by ISP.

I have another similar setup elsewhere with one WAN with pfSense 2.1.5 and the NAT works just fine there. So I tried removing one WAN from this box but had no luck.

I am sure doing something wrong here but my head is not working at this point and cannot get pass this. Can someone please lead me to right direction? I will really appreciate it.

Thanks

[nxT]

Actually the NAT is working.

When I am loading from a remote network it works https://XXX.XXX.162.220:8006

States
WAN1LK tcp 192.168.100.2:8006(XXX.XXX.162.220:8006) <- 5.178.78.78:47805 FIN_WAIT_2:FIN_WAIT_2
LAN tcp 5.178.78.78:47805 -> 192.168.100.20:32400 FIN_WAIT_2:FIN_WAIT_2

But when I am loading https://XXX.XXX.162.220:8006 from a local client

States
LAN tcp XXX.XXX.162.220:8006 <- 192.168.100.102:50541 CLOSED:SYN_SENT

I guess I need to add some rules for local net? I have tried different combination but can't figure out. Hopefully someone can help me with this part.

Thanks

[phil.davis]

This is a NAT reflection thing. The easy way is for internal LAN clients to use the actual LAN IP of the server - 192.168.100.2:8006 - whatever is the DNS name on the public internet that resolves to XXX.XXX.162.220, say server.mycompany.example.com
Add a Host Override on pfSense for server.mycompany.example.com to 192.168.100.2
Then internal LAN clients can use that name and go directly to 192.168.100.2, thus avoiding the whole NAT reflection thing.