<![CDATA[Complicated NAT Question]]>Greetings,

I am using 2.2.6 pfSense as my router/firewall.  I have two static IPs, which for the purposes of the question we'll say are 1.1.1.1 and 1.1.1.2.

I want 99.9% of my network traffic to go out to the Internet as 1.1.1.1, but I would also like to NAT any and all traffic for my web server for 1.1.1.2.  I have a very heavy Cisco background, both in routers & firewalls, and I think it is proving more of a hindrance than a help in this situation.

Can anyone please point me to some documentation about how to create this functionality in pfSense?  My searches seems to have turned up conflicting or unclear information.

My thanks!

]]>https://forum.netgate.com/topic/95271/complicated-nat-questionRSS for NodeWed, 15 Jul 2026 19:14:27 GMTTue, 09 Feb 2016 18:49:32 GMT60<![CDATA[Reply to Complicated NAT Question on Thu, 11 Feb 2016 11:02:10 GMT]]>No you do not need to remove the auto..  You need to make sure that the webserver talks back out the same IP it came in.

]]>https://forum.netgate.com/post/601955https://forum.netgate.com/post/601955Thu, 11 Feb 2016 11:02:10 GMT<![CDATA[Reply to Complicated NAT Question on Thu, 11 Feb 2016 07:47:05 GMT]]>Yes.  The IPs are both on the same connection.

Thanks for your reply.

Just to be sure I understand, I will:

1. Create appropriate NAT and Firewall rules for Incoming from Virtual IP that point the the web server.
2. Create an outbound NAT rule for my web server to use the Virtual IP.

One other question:  Do I need to remove the auto-generated outbound NAT rules, or will my manual outbound NAT rule be prioritized over them?

Once again, my thanks!

]]>https://forum.netgate.com/post/601916https://forum.netgate.com/post/601916Thu, 11 Feb 2016 07:47:05 GMT<![CDATA[Reply to Complicated NAT Question on Tue, 09 Feb 2016 20:10:46 GMT]]>Are these public IPs on different connections or the same one.  So your wan on pfsense as 1.1.1.1, create a vip for 1.1.1.2 and forward traffic to your webserver via your vip.  And then on your outbound nat setup your webserver to use the vip for its outbound traffic.

]]>https://forum.netgate.com/post/601611https://forum.netgate.com/post/601611Tue, 09 Feb 2016 20:10:46 GMT