2

I've got a pfSense box which is acting as DHCP/DNS for one LAN, which all office computers and servers connect to.

We have a modem which cannot be put into bridge mode for several reasons and cannot be swapped out for another bridgeable modem as we use certain services from the ISP that only function with their (rather crappy) modem.

We can, however assign a PC on the Modem's LAN to be a DMZ, which I've done, selecting the pfSense box as DMZ, no other devices other than this are on the Modem's LAN.

The issue I face is this: I can't port forward from the pfSense box to any other computer/server on the pfSense LAN. I confirmed that the Modem's DMZ is working as I connected a server directly to the Modem's LAN and was able to access services from our public IP. Also, we used to use a Windows server for DHCP and Routing and Remote Access, which included a very basic port forward function which did work. The only thing we've changed is the installation of the pfSense box as the Windows server died.

How do I port forward using pfSense under these conditions.

Improve this question
14
  • 1
    Why use NAT on the router? It sounds like the modem is doing NAT. You only need to NAT once.
    – Ron Maupin ♦
    Commented Oct 12, 2016 at 14:50
  • We don't want people to be able to access certain ISP-provided devices on the Modem's LAN network, which has proved to be an issue in the past. We also run two network boot services (one Windows PXE, one Apple NetInstall) which we can't get working on the ISP's Modem, but has always worked on a third-party router/pfSense.
    – Thomas Jones
    Commented Oct 12, 2016 at 14:55
  • 1
    You can use the firewall to prevent that, and use the pfSense router, without using NAT. I really don't see the need for the second NAT.
    – Ron Maupin ♦
    Commented Oct 12, 2016 at 15:01
  • Another issue is the very limited interface you have on the ISP's Modem, you get either one PC as a DMZ or a small preset list of no-custom-ports-allowed services to port forward to multiple computers.
    – Thomas Jones
    Commented Oct 12, 2016 at 15:05
  • The solution to me was to add a better router in place to deal with the limitations of the Modem, which had worked until now, which is something I cannot figure out after trying a variety of configurations on pfSense.
    – Thomas Jones
    Commented Oct 12, 2016 at 15:06

1 Answer 1

Reset to default
0

I think you really just need to disable NAT on the pfSense router/firewall. You simply don't need to use NAT to route or use the firewall. You can use the firewall to disallow users from accessing the ISP services, and you get the boot services that work on pfSense. This should solve the double-NAT port forwarding problem.

The pfSense documentation tell you how to disable the firewall:

Disable NAT

To completely disable NAT to have a routing-only firewall, do the following.

pfSense 2.2 And Later

  1. Navigate to Firewall > NAT on the Outbound tab
  2. Select Disable Outbound NAT rule generation (No Outbound NAT rules)
  3. Click Save
  4. Apply changes

Prior Versions

  1. Navigate to Firewall > NAT on the Outbound tab
  2. Select Manual Outbound NAT rule generation (Advanced Outbound NAT (AON))
  3. Click Save
  4. Delete all rules from the list on the page
  5. Click Apply changes

NAT may be performed on some interfaces and not others by configuring Outbound NAT rules accordingly.

Details may be found in the pfSense book.

Improve this answer
16
  • Disabling NAT has the effect of preventing PCs on the pfSense LAN from connecting to the internet.
    – Thomas Jones
    Commented Oct 13, 2016 at 1:04
  • You must be keeping a separate local network from the network assigned by the modem. If you let the modem assign the network and addresses, you should have no problem. Set up pfSense as a layer-2 firewall. I get the impression you don't understand what is going on or how networking actually works.
    – Ron Maupin ♦
    Commented Oct 13, 2016 at 1:06
  • I have a pretty basic knowledge of networking, this is true. The thing is, the windows server was able to work/port forward in this environment, while the pfSense one is having difficulty doing so. We require DHCP on the pfSense box to be enabled/have it assign addresses as we have DHCP options that need to be set in order for some PCs to discover the PXE server.
    – Thomas Jones
    Commented Oct 13, 2016 at 1:09
  • If pfSense is the source of your trouble, you need to replace it with a router which works. You could block DHCP messages at the layer-2 pfSense firewall so that the modem never sees them, and let pfSense still perform DHCP. DHCP servers built into routers are really a sort of last resort. Normally, you want a dedicated DHCP server, even if it is only a VM in a physical server.
    – Ron Maupin ♦
    Commented Oct 13, 2016 at 1:14
  • At this current point in time, doing a major overhaul and change/spinning up a new VM isn't possible. I would just like to see if anyone can tell me what you need to do with pfSense to get it to port forward properly under these conditions.
    – Thomas Jones
    Commented Oct 13, 2016 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.