0

I'm a little bit confused and pretty sure it won't work. But a mate and me are arguing for so long now, I decided to ask you.

Imagine a PFSense Firewall with 3 Interfaces. 2 different LAN-Interfaces 1 WAN-Interface

Behind one of the LAN-Interfaces is a Server. Its IP is NATted on the PFSense to a nonRFC1918-IP. Behind the other LAN-Interface is another Server whose IP is NATted on the PFSense to a nonRF1918-IP. For communication via WAN we have proxy-arp configured with two different IP-addresses for the two servers.

Now I want the first server to communicate with the other Server without knowing its private IP. So I tried building rules on LAN-side which allow traffic from 1st Server RFC-1918-IP to 2nd Servers nonRFC1918-IP (the proxy-arp-IP). As expected...it doesn't work. Does anyone know a solution for this to work? I know that the servers could communicate via their private IPs...but it's a must have because of PCI compliances and things. The system should be out of PCI-scope, so it's the only way to get it to work.

Hopefully Flo

P.S.: If it's not clear enough, maybe I can paint a picture for you ;)

Improve this question
5
  • You could set up DNS so that each host can contact the other host via DNS that would resolve to the local address of the other host. Otherwise, you must be able to do hairpin routing, and not all routers can do that. – Ron Maupin♦ May 30 '17 at 14:09
  • Hi Ron, that's exactly my problem. I mustn't use the private IP because the servers then would be in PCI-scope. I have to avoid that. Hairpin routing seems to be the word I was looking for ;) Lemme check that and thank you! – flo May 30 '17 at 14:16
  • OK. That is a poor practice that can be a security problem. Also, understand that proxy ARP, is a huge security hole. – Ron Maupin♦ May 30 '17 at 14:21
  • Alternatively, you could destination NAT from private IP directly to private IP, avoiding the public IP and hairpin issue. – Zac67 Jul 9 '17 at 16:46
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 8 '17 at 17:00
1

Okay, the solution for my problem in PFSense is called "NAT reflection". If this feature is enabled, it works like expected.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.