Multiple WAN-ip: Use Virtual IP or use second network adapter?
-
This was posted before on the NAT forum without any answers. Realizing that the Multi-WAN sub-formum is more appropriate I am trying again:
–--
I have two external WAN ip-addresses, one ending in .135 en one ending in .136. This I want to NAT as follows:x.y.z.135 port 80 --> internal webserver 1
x.y.z.135 port 25 --> internal mailserver 1
x.y.z.136 port 80 --> internal webserver 2
x.y.z.136 port 25 --> internal mailserver 2The usual solution I find is to assign x.y.z.135 to the WAN port and make the other ip x.y.z.136 a Virtual IP. Next I can use NAT port forwarding on the new Virtual IP.
Alternatively, as I am running my pfSense virtualized on ESXi 6, I could also add another network card and have a completely separate WAN interface for the second ip-address. That way I would not need Virtual IP's at all (I think).
The second solution with an extra adapter seems much simpler to me. Why do I never find that as a suggestion on the Internet or on this forum. Am I overlooking something?
-
The second solution with an extra adapter seems much simpler to me. Why do I never find that as a suggestion on the Internet or on this forum. Am I overlooking something?
Because then you have two interfaces on the same subnet. Use virtual IPs. It's actually much simpler.
-
I am probably confused because making one of them a Virtual IP suggest that one is more important than the other while both are equal in my case.
Does it matter which one is made the virtual one?
-
No.
https://doc.pfsense.org/index.php/What_are_Virtual_IP_Addresses
You will need to use a type that has the characteristics you want. The only requirement is that is be usable for NAT. You have to decide if you want it to respond to pings, etc. I'd probably use an IP Alias type for port forwards like that.
-
The table on that page lists the features of the different VIP types but does not explain why I would need a VIP in the first place.
If a fifth row were added to the table for 'a separate adapter', how would that look like? Is there anything that cannot be done with a second adapter that can be done with VIP's?
Just trying to understand….
-
As has been said you will then have two adapters on the same subnet. Think about it. Which adapter should pfSense use to get to the ISP default gateway on WAN? It would be a broken config at the basic IP layer. Use a VIP. Don't overthink it.
-
Respectfully disagreeing with Derelict, I wouldn't use an alias unless the VIP was in a different subnet. I would use a proxy arp for a simple setup.
