1:1 NAT for an entire subnet - am I understanding this correctly?

[sforsythe]

So our company has just moved to pfsense to replace Dell branded SonicWalls.
We are new to pfsense/*bsd and have hit a stumbling block.

We have (2x)  /24 networks (for redundancy) and (1x) /22 network ….

If we want the IP Addresses to be pingable and use 1:1 NAT ... we have to manually create an IP Alias for each and every ip address in the subnet?  That seems crazy!

In other firewalls I have used (not just Sonicwall) .. you can say something like
    AAA.BBB.CCC.0/24 -> 10.10.1.0/24

For Sonicwall at least, that is almost literally the default option, take the WAN subnet and if same class as LAN subnet, make rule to NAT.

If we were so inclined to manually create rules for our 3 networks, that would be : 253 + 253 + 1012 = 1,518 virtual IPs

Can the pfsense software/gui scale that big? We are using 2 SG-8860 for H.A.

Thanks for any help or suggestions how to tackle.

[Derelict]

Why not just put the public subnets on pfSense interfaces and stop NAT entirely?

Need more information about the subnets and what's routed to where.

[johnpoz]

I can understand the 1:1 NAT in the case of say a site to site vpn where one site is using the same network space as you, etc.

And even then the better plan in that would be to renumber 1 side.  I don't understand why anyone in their own network would want to 1:1 nat a whole subnet to be honest..

I am with Derelict here - I think way more information is needed.

[sforsythe]

We have an IP space given to us by our provider,  AAA.BBB.CCC.0/24

AAA.BBB.CCC.1 is the upstream provider router/gw. The whole subnet is routed to it and sent to us through its port.
Our firewall (for legacy reasons) WAN is AAA.BBB.CCC.4  , our LAN is 10.10.1.0/24

While not the full 250+ ip address, for various clients/purpose we have fairly close to at least 80-100+ unique IPs (webservers, mail, ftp,etc) on the LAN that use the 1:1 nat to be publically addressable.

I'm not sure I understand what you mean by

Why not just put the public subnets on pfSense interfaces and stop NAT entirely?

[johnpoz]

Your network AAA.BBB.CCC.0/24 should be ROUTED to you via a transit network. Not just hung off your isp equipment - where you point to AAA.BBB.CCC.1 as your gateway.

This way you put that /24 behind pfsense and just have to firewall the connections to it - no nat, not port forwarding, etc.

[Derelict]

Just to be clear your WAN port has a /24 netmask right?

What is this about another /24 and a /22?

johnpoz is describing something like this:

Have your provider assign you something like a /29

Network: 8.6.5.0
Gateway: 8.6.5.1
YOUR WAN: 8.6.5.4
Netmask: 255.255.255.248

Then your provider routes aaa.bbb.ccc.0/24 to 8.6.5.4

You configure OPT1

Network: aaa.bbb.ccc.0
OPT1 Address: aaa.bbb.ccc.1
Netmask 255.255.255.0

Then you give your servers aaa.bbb.cc.2, aaa.bbb.ccc.3 etc.

Disable outbound NAT on WAN for aaa.bbb.ccc.0/24.

[sforsythe]

Just to be clear your WAN port has a /24 netmask right?

What is this about another /24 and a /22?

You can disregard that, yes our WAN has a /24 
… the other /24 and /22 are separate networks from another provider (which will be handled by separate hardware)

Thanks for your description, that makes it a lot clearer.  Will work with provider and see if they can provide something similar.