NAT all traffic from alias except a single port/IP
-
Hi All,
I'm not sure if i've set this up properly as i'm getting some slow speeds from my alias devices, we'll call the alias VPN_alias. I have two rules setup:
1)I have a NAT Outbound rule setup to go through an OpenVPN client so that all traffic in/out is going through my VPN connection for VPN_alias.
2)I created another NAT Outbound rule that references one specific IP within VPN_alias and is going to the destination port i specified. This rule is above the other rule.It doesn't seem to be following the second rule properly. I'm sure there is a way to set this up more efficient but I don't know how to set it up.
Any guidance would be appreciated!
-
Don't describe what you think you have done. Post screens of your firewall & NAT rules.
-
Added Screenshots…sorry about that.
-
You probably don't want to set a source port to match on. Source ports are almost always random.
-
If you want the source port to keep the same after NAT check "static port" in translation section.
-
Thank you for the tips. I have done these but haven't had time to reboot my systems or test anymore.
I will take a look later.
-
Reboot? No reboot necessary to change rules.
-
Should be seeing it immediately after applying? I'll have to take a look at the logs then.
-
I never reboot pfSenses except when I update them.
-
I just tested updating this rule on the fly. I've updated the 2nd rule several times with no different results to get a specific port through. The port always stays going through the OpenVPN interface.
I have added a rule to the firewall rules and messed around with the port that the rule uses, but have had no luck.
Any other insight into how to get this working properly?
-
Just so it's clear, outbound NAT rules do absolutely nothing to forward traffic. The simply tell the router how to NAT any traffic outbound on the subject interface. The traffic has to be routed out the interface by other means first.
That said, you don't need the specific NAT rule. The auto-generated rules will NAT the traffic just fine.
It looks like you are trying to policy route https connections from 192.168.1.62 out WAN_DHCP instead of OPT1TOPIA_VPN4.
Is 192.168.1.62 in alias OVPN_hosts?
I just tested updating this rule on the fly. I've updated the 2nd rule several times with no different results to get a specific port through. The port always stays going through the OpenVPN interface.
I have added a rule to the firewall rules and messed around with the port that the rule uses, but have had no luck.
Highlighted are places you should be more specific. IP addresses, interface names, port protocols and numbers.
What, specifically, are you trying to do?
-
Yes, you're correct in that 192.168.1.62 is in OVPN_hosts.
I just tested updating NAT Outbound rules on the fly. I've updated the 192.168.1.62 rule several times with no different results to get port 443 through. 443 always stays going through OPT1TOPIA interface.
I have added the 443 firewall rule and messed around with the port range in that rule, but have had no luck.
Hope that gives you more of an idea of what i've done. The screenshots really show all the changes i've done, but they haven't done anything.
-
How are you testing?
-
Checking traffic graphs, interface stats and the speeds are not what they should be. Speeds should be flying when not on the VPN, but i'm seeing quite slow speeds.
-
That's no way to test routing. All you should be caring about it what interface your traffic is going out on. Performance is another issue.
Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?
-
That's no way to test routing. All you should be caring about it what interface your traffic is going out on. Performance is another issue.
Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?
I specified that i am looking at my traffic graphs/interface stats which show the traffic that is going in/out on my 192.168.1.62 machine is being routed through the OPT1TOPIA interface. The OPT1TOPIA interface is nearly the same as the LAN/WAN interface when testing. The 192.168.1.62 machine is a linux box and testing it via cmd line to ipchicken shows that it is using the OPT1TOPIA IP address, though i'm not sure how to test a specific port. Not sure if you'd be able to verify that only port 443 is going through a different IP address via ipchicken or wimi.
All of the traffic going to 192.168.1.62 is going through the OPT1TOPIA interface in my graphs and logs. Performance is directly related to VPN connectivity since PIA doesn't have the bandwidth to support my full 300mbps download bandwidth.
-
Well, what you have posted looks right so you must have something someplace else. Did you mess around in floating rules?
-
I haven't touched much other than that what you're seeing. These were the instructions i followed to get PIA OpenVPN setup to only that alias:
https://forum.pfsense.org/index.php?topic=72902.msg397636#msg397636
-
Doesn't matter what a walkthrough says. What matters is what your config is.
There must be something somewhere else or it would be working.
If you disable the VPN is 192.168.1.62 happy routing out the WAN_DHCP interface?
-
I was just giving a reference to what I did.
I will test that in a bit as i'm not home.
