Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2 different external IP address for same network

    Scheduled Pinned Locked Moved NAT
    19 Posts 4 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      sangour111
      last edited by

      hey
      I have 2 pfsense connected with different external IP address in the same router

      i con't connect from
      41.xx..xx.xx to 42.xx.xx.xx  or 42.xx.xx.xx

      why !

      ican't ping one pfSense from the other and can't get to your FTP server from your PC
      but from outside network i can to my ftp server

      the problem from pfsense or router

      1 Reply Last reply Reply Quote 0
      • KOMK Offline
        KOM
        last edited by

        i con't connect from

        What do you mean?  You can't ping one pfSense from the other?  or you can't get to your FTP server from your PC?  What exactly is the problem?  Details are important if you expect someone to help you.

        1 Reply Last reply Reply Quote 0
        • S Offline
          sangour111
          last edited by

          please sorry  :-[
          yes
          ican't ping one pfSense from the other and can't get to your FTP server from your PC
          but from outside network i can get to my ftp server

          1 Reply Last reply Reply Quote 0
          • KOMK Offline
            KOM
            last edited by

            ican't ping one pfSense from the other

            The default WAN rules will not allow that, so ping will always fail unless you add a rule that allows ICMP on WAN.

            can't get to your FTP server from your PC but from outside network i can get to my ftp server

            https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks

            Use Method 2

            1 Reply Last reply Reply Quote 0
            • johnpozJ Offline
              johnpoz LAYER 8 Global Moderator
              last edited by

              So your saying from public say 1.2.3.4 you can get to your ftp.  But from your pc behind pfsense 1 and you can not get to ftp server behind pfsense2

              So your natting these 41. and 42. address in the cisco router - what IPs are on the pfsense box wans and lans?  Are they rfc1918?  Well by default wan blocks access from rfc1918 before any rules you would create so while public 1.2.3.4 would be allowed by your forward rule on pfsense2 coming a rfc1918 address on pfsense 1 wan would be blocked.

              And as already mentioned ping would be blocked no matter if from public IP or rfc1918 unless you created a rule to allow it.  And again even if you create a rule - if from rfc1918 it would still be blocked unless you turn off block rfc1918

              You could also have a nat reflection problem on your cisco if your trying to hit the 42. address from pc behind pfsense1

              Really need more details to know for sure what your issue is or could be.  I assume pfsense wans are private ips since you show 1:1 nat that looks like is happening on your cisco.

              Details!!!

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • S Offline
                sangour111
                last edited by

                I have this config in pfsense 2

                from outside network i can access but from pfsense 1 to pfsense 2 i'cant

                1 Reply Last reply Reply Quote 0
                • johnpozJ Offline
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Well your forward is WRONG, your dest needs to be your actual address not *

                  And clearly you have block private on there.. So again lets ask
                  "So your natting these 41. and 42. address in the cisco router - what IPs are on the pfsense box wans and lans?"

                  What is the IP address on pfsense WAN.. Is it actually that 42 and your 1:1 natting to what on it??

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    sangour111
                    last edited by

                    i nating nat 1:1  from cisco  192.168.0.5 >>>41.xx.xx.xx  pfsense1
                                                            192.168.0.6>> 42.xx.x.xx  pfsense2
                    cisco lan >> 192.168.0.1
                    wan pfsense 1 >>> 192.168.0.5
                    wan pfsense 2 >> 192.168.0.6

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      doktornotor Banned
                      last edited by

                      The problem is that FTP is enough broken with ONE layer of NAT. Why are you double-NATing?

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        So you need to have nat reflection setup if you want pfsense 1 to get pfsense 2 wan on cisco most likely. Or make sure its not blocking rfc1918 from its fowards, etc..  If your going to its wan directly via the 192.168.0 address your rfc1918 blocks it..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • S Offline
                          sangour111
                          last edited by

                          it is problem from outbound NAT  !!!!!!! or what

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            sangour111
                            last edited by

                            please i need help

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ Offline
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              So how are you accessing the ftp?  The public 42 address that is on your cisco wan or your 192.168 address that is on wan of pfsense2? Are you using active or passive?  How do you have it forwarded on pfsense 2?

                              You say it works from outside.. ARe you using active or passive for this to work.. Do you understand even what active or passive ftp is?

                              http://slacksite.com/other/ftp.html

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                sangour111
                                last edited by

                                no problem with ftp because i can get ftp server from any outside network
                                i use passive mode

                                i access from outside in ftp server with public ip 42.xx.xx.xx and it is work

                                but from pfsense 1 not working with 192.168.0.5 or 42.xx.xx.xx

                                in pfsnese 2 >>> wan>> 192.168.0.5            public ip >>42.xx.xx.xx

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ Offline
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  So what flavor of pfsense are you running?  ftp helper was pulled out multi versions ago.  So did you setup forward of the passive ports you use on your server?

                                  So in your ftp server you hand out what IP in the passive command..  Lets see log of ftp from your client.. If it hands out your 42.x address when you connected to 192.168.0 on control that is going to be an issue most likely and if you hand out your 172 address how is that routed?

                                  example here is me connecting to local ftp
                                  05:03:35Command:PASV
                                  05:03:35Response:227 Entering Passive Mode (192,168,9,8,19,213)

                                  Tells my client to connect to 192.168.9.8 (19x256)+213 or port 5077  From outside there was a recent thread where I opened up ftp to the outside to show a person how to setup the passive forward.. You can see from that pic attached when I connect from outside it sends my public IP, but when local it sends local IP..  So does it send you 172 or the 42?

                                  Your setup is way more complex than it needs to be for sure..  What is your cisco, why not just use that.. Why do you have 2 different pfsense?  Why not just use one and put your different segments off the 1 pfsense? etc. etc.. Trying to use a antiquated protocol like ftp that has control and data channels with active and passive modes through a double nat and funky routing and nats between internal networks, etc..  KISS

                                  passivebehindpf.png
                                  passivebehindpf.png_thumb

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • D Offline
                                    doktornotor Banned
                                    last edited by

                                    Not to spoil your party, but… FTP simply won't work properly like this. NAT reflection won't do anything either, since it'd have to be done on the Cisco box, not on pfSense. In general, waste of time. Move on. Sanitize your multi-NATed setup or switch to a less broken and more secure protocol.

                                    1 Reply Last reply Reply Quote 0
                                    • S Offline
                                      sangour111
                                      last edited by

                                      it is problem from cisco or pfsense !!
                                      it is  problem name NAT Hairpin  !!

                                      1 Reply Last reply Reply Quote 0
                                      • D Offline
                                        doktornotor Banned
                                        last edited by

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ Offline
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          Your problem if you ask me is not understanding the basic principles of ftp when used with nat and passive and active.  And then an over complex setup from the get go.  You clearly have a multiple nat setup where your natting your public IP to your pfsense wan, and then natting again on pfsense to networks behind pfsense?

                                          I would simplify that setup.  Why do you not just replace your cisco with pfsense box?  And then run segments off that pfsense?  If you set on using cisco at the front, why just just use 1 pfsense behind it.  If your set on using 2 of them?  Are they in different locations?  Why nat rfc1918 space again - why not just route those networks?  I would use transit networks from your cisco to your pfsense boxes in that case, etc.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.