PfSense 2.2 - MultiWan - NAT

  • Hi guys!

    I have setup pfSense 2.2 in Promox VM100 with Virtio Driver.

    Created Linux Bridge vmbr0 with eth0 in promox and bridge net0, net1, net2 with vmbr0 in pfsense vm

    In pfSense VM
    Assigned WAN1 (net0) - XXX.XXX.175.203
    Assigned LAN (net1) -
    Assigned WAN2 (net2) - XXX.XXX.162.220

    Created Gateway Groups
    WAN 1 : Tier 1
    WAN 2 : Tier 1

    Created firewall rules to support these group

    Any client PC can browse and get combined gateway speed fine. FreeNAS also working fine in VM101 in Proxmox

    But I cannot make NAT working at all and cannot connect to any internal box with NAT from Public IP with ports. If I enable HTTPS (443) in WAN Firewall Rules I can see the pfSense login page but the NAT forwarding not working at all.

    https://XXX.XXX.162.220:8006 ->

    I also checked with external services and my PORTS are not blocked by ISP.

    I have another similar setup elsewhere with one WAN with pfSense 2.1.5 and the NAT works just fine there. So I tried removing one WAN from this box but had no luck.

    I am sure doing something wrong here but my head is not working at this point and cannot get pass this. Can someone please lead me to right direction? I will really appreciate it.


  • Actually the NAT is working.

    When I am loading from a remote network it works https://XXX.XXX.162.220:8006

    WAN1LK tcp <- FIN_WAIT_2:FIN_WAIT_2
    LAN tcp -> FIN_WAIT_2:FIN_WAIT_2

    But when I am loading https://XXX.XXX.162.220:8006 from a local client

    LAN tcp XXX.XXX.162.220:8006 <- CLOSED:SYN_SENT

    I guess I need to add some rules for local net? I have tried different combination but can't figure out. Hopefully someone can help me with this part.


  • This is a NAT reflection thing. The easy way is for internal LAN clients to use the actual LAN IP of the server - - whatever is the DNS name on the public internet that resolves to XXX.XXX.162.220, say
    Add a Host Override on pfSense for to
    Then internal LAN clients can use that name and go directly to, thus avoiding the whole NAT reflection thing.

Log in to reply