I'm a little bit confused and pretty sure it won't work. But a mate and me are arguing for so long now, I decided to ask you.
Imagine a PFSense Firewall with 3 Interfaces. 2 different LAN-Interfaces 1 WAN-Interface
Behind one of the LAN-Interfaces is a Server. Its IP is NATted on the PFSense to a nonRFC1918-IP. Behind the other LAN-Interface is another Server whose IP is NATted on the PFSense to a nonRF1918-IP. For communication via WAN we have proxy-arp configured with two different IP-addresses for the two servers.
Now I want the first server to communicate with the other Server without knowing its private IP. So I tried building rules on LAN-side which allow traffic from 1st Server RFC-1918-IP to 2nd Servers nonRFC1918-IP (the proxy-arp-IP). As expected...it doesn't work. Does anyone know a solution for this to work? I know that the servers could communicate via their private IPs...but it's a must have because of PCI compliances and things. The system should be out of PCI-scope, so it's the only way to get it to work.
P.S.: If it's not clear enough, maybe I can paint a picture for you ;)