Pf Beginner requesting help

[digimedia]

I wasn't sure whether this topic would go under NAT, CARP, or MultiWan so here it goes. I have gone through countless pages and endless searching and, not that i havent seen a solution through searching, i somewhat dont understand it due to different setups etc. I am hoping this will be trivial for the experts out there so please advise this noob on how to set this up correctly.

At present i have:
1 /32 ip by ISP
block of 4 on /30 also provided by ISP.

I am currently running an ADSL modem on full-bridge mode and the pfsense box is handling the authentication via PPPoE. I have gone through several posts, and i am somewhat confused by the interchangable terms like 'using VLAN, Virtual IPs, CARP as opposed to ProxyARP, and 1:1;. Could somebody out there possibly provide me with some light as to how i could get these additional IPS operational.

Any help is much appreciated.

Cheers.

[sai]

probably best if you put up a network diagram of what you are trying to implement. include the ip addresses , masks and gateway of everything.

[digimedia]

Thank you for your reply Sai,

I roughly sketched up what i want to achieve out of the network, but if you have any suggestions that may improve this(because i think this design is very flawed), let me know. What i have done so far is ive managed to map the /30 ips by creating VLANS. What i want to do now is to be able to map those /30s to communicate with my /24 machines. Im not sure if that feasible or not for a /30 to point to a /24. Im confused as to how i should i approach this. Please provide me with some guidance.

Thanks in advance.

[sai]

you dont need VLANS.  http://en.wikipedia.org/wiki/VLAN

if you want to map your REAL ip addresses (on the /30) to your private ip addresses (on the /24) then you need NAT

so, if anyone on the internet tries to access your real ip he gets through to your server with a private ip ?

Let say that you have a.b.c.d as your WAN address. You want this to NAT to your mail server on 192.168.1.66  , so that when someone sends mail to you the mail server can handle it

Firewall: NAT: Port Forward
add a rule
Interface: WAN
External address: Interface address (if you want to add more IP addresses here you need to do this under Proxy ARP in the Firewall: Virtual IP Address menu)
External port range: the range of ports on the incoming packets (for mail that would be port 25 to port 25)
NAT IP:  192.168.1.66
Local port: 25
Description: SMTP packets to be sent to the mail server

now you need to add a firewall rule for this , which can be done by keeping the tick box next to "Auto-add a firewall rule to permit traffic through this NAT rule"

[digimedia]

Thanks again for your reply Sai,

Ill give that a shot, then ill let you know.

Cheers.

Edit: Instead of manually creating entries for every port, is there a faster way to open all ports to an internal PC using this method? (DMZ)

[GruensFroeschli]

Well you can define port ranges instead of single ports.

If you have multiple single ports you want to forward: use aliases

[digimedia]

Thank you Sai and GruensFroeschli,

Your support has been much appreciated.

This thread can be closed.