Logging NAT ports
-
We have a requirement to forward "copyright infringement" notices to users on our LAN. The notice includes the IP address, a port number, and time. Unfortunately, the users are behind NAT so this information is not very helpful.
We've looked at firewall logs, but they only record the inside and remote hosts, not the intermediate state on the WAN. Is there a way to log the port on the WAN side of the pfSense, along with the LAN host details?
-
Not currently, though logging NAT translations is something we hope to do over time.
Currently your best bet is to track connections with something like netflow (exported from softflowd to a central netflow server on your network) – from there you can drill down and locate connection information by ip/port/etc. The exact bits you can search depend on your netflow server.
