Timeline for Port Forwarding on unavoidable Double-NAT pfSense
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 9, 2017 at 3:55 | vote | accept | Thomas Jones | ||
| Oct 13, 2016 at 15:59 | comment | added | Ron Maupin♦ | Not particularly complicated. A firewall should block DHCP by default, as yours seems to do. You just need to set it up as a layer-2 firewall instead of a layer-3 firewall. Basically, just turn off routing on pfSense. | |
| Oct 13, 2016 at 15:45 | comment | added | Thomas Jones | Layer-2 firewall that blocks DHCP from the modem seems overly complicated, it's already more complicated as it is now. | |
| Oct 13, 2016 at 15:42 | comment | added | Ron Maupin♦ | Did you ask about bugs or patches on the pfSense forums? CGN would explain why it doesn't work since you can't forward on the ISP NAT. I did give you a workaround (layer-2 firewall blocking DHCP from the modem). | |
| Oct 13, 2016 at 15:39 | comment | added | Thomas Jones | Just seems so strange and unnecessarily difficult to me, there MUST be a way around this issue, some quick hack or hotfix or PHP code patch... | |
| Oct 13, 2016 at 15:37 | comment | added | Ron Maupin♦ | OK. I just wanted to make sure the the ISP didn't start using CGN. That is happening more and more. If double-NAT isn't working for you with pfSense, you may need to look at a better router. | |
| Oct 13, 2016 at 15:35 | comment | added | Thomas Jones | They are one in the same address. | |
| Oct 13, 2016 at 15:34 | comment | added | Ron Maupin♦ | I'm not asking about the public address. What address is assigned on the ISP side of the modem. Those can be different addresses. A user where the ISP has used CGN can find his public address by going to a website, but that is not the address which the ISP has assigned to the user. | |
| Oct 13, 2016 at 15:27 | comment | added | Thomas Jones | 101.187 is the beginning of my public IP address. | |
| Oct 13, 2016 at 11:31 | comment | added | Ron Maupin♦ | And just to make sure you are not now dealing with CGN, what are the first two octets of your IPv4 WAN address? | |
| Oct 13, 2016 at 1:23 | comment | added | Ron Maupin♦ | @ThomasJones, by the way, as I wrote, you can still use the pfSense DHCP server to assign host addresses in the network which the modem defines. Just block the the DHCP requests/replies on the firewall, configured as a layer-2 firewall, from traveling to/from the modem. | |
| Oct 13, 2016 at 1:21 | comment | added | Ron Maupin♦ | You have not put any configuration which you have tried, and where it fails for you, in your question. You need to describe what you have tried, and what your specific problem with it is. Include any logs or test to show the problem. | |
| Oct 13, 2016 at 1:17 | comment | added | Thomas Jones | At this current point in time, doing a major overhaul and change/spinning up a new VM isn't possible. I would just like to see if anyone can tell me what you need to do with pfSense to get it to port forward properly under these conditions. | |
| Oct 13, 2016 at 1:14 | comment | added | Ron Maupin♦ | If pfSense is the source of your trouble, you need to replace it with a router which works. You could block DHCP messages at the layer-2 pfSense firewall so that the modem never sees them, and let pfSense still perform DHCP. DHCP servers built into routers are really a sort of last resort. Normally, you want a dedicated DHCP server, even if it is only a VM in a physical server. | |
| Oct 13, 2016 at 1:09 | comment | added | Thomas Jones | I have a pretty basic knowledge of networking, this is true. The thing is, the windows server was able to work/port forward in this environment, while the pfSense one is having difficulty doing so. We require DHCP on the pfSense box to be enabled/have it assign addresses as we have DHCP options that need to be set in order for some PCs to discover the PXE server. | |
| Oct 13, 2016 at 1:06 | comment | added | Ron Maupin♦ | You must be keeping a separate local network from the network assigned by the modem. If you let the modem assign the network and addresses, you should have no problem. Set up pfSense as a layer-2 firewall. I get the impression you don't understand what is going on or how networking actually works. | |
| Oct 13, 2016 at 1:04 | comment | added | Thomas Jones | Disabling NAT has the effect of preventing PCs on the pfSense LAN from connecting to the internet. | |
| Oct 12, 2016 at 15:41 | history | answered | Ron Maupin♦ | CC BY-SA 3.0 |