I have the following network: - Edge Lite 3 router with public IP on WAN (eth0) and 2 LANs: 1) eth1 2) eth2

eth1 is DHCP, I have several work laptops inside.

eth2 goes to a pfSense firewall with ip (on its WAN interface)

I have NAT rules for several ports I need, from WAN to

The LAN ip of pfSense the IP is

Behind it I have a web/dc/sql server (, a NAS (, another DC ( and we continue to add as we separate and scale the roles.

pfSense has NAT rules from WAN to the web server (we we are in the double NAT scenario).

The website works with no issues, being accessible from the internet.

The 2 LAN interfaces eth1 and eth2 of the Edge router should be independent, we don't want to be able to directly access eth2 from eth1 laptops.

Network diagram:

enter image description here

What we need is to access the website from the machines in eth1. Currently we have the error 404 not found in browsers.

nslookup shows server unknown with address, and for the non-authoritative address, the correct name and public ip.

tracert for the website name has one step, the public ip.

How can we do for the requests from eth1 (workstations in DHCP) to be treated by pfSense like any other requests from the internet?

Many thanks!

  • "and remove NAT from pfSense (though the security will kill me)." NAT has nothing to do with security. The firewall is what provides security. NAT should only be used where it must be used (private to public addressing or overlapping addressing). A firewall will, by default, drop any unsolicited traffic, and you then set up rules to allow specific traffic. Thinking that NAT provides security is a rookie mistake.
    – Ron Maupin
    Jan 3, 2019 at 14:57
  • Hi Ron, thanks for the answer! pfSense interface has NAT under the Firewall section and that tricks me. For each NAT port forward, I created a rule (443 Pass, 80 Pass). When the pfSense was installed for me, I understood from the pfSense engineers that each port that is not explicitly "NATed", is by default not forwarded. And for each port forward with no rule configured, the default action is Block. So as I understood, NAT is the opposite to security because I open and let pass traffic through ports. My question still remains... Jan 4, 2019 at 12:21
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Apr 19, 2019 at 6:25

2 Answers 2


You'll want to bypass your router/firewall completely for internal services, whether or not they are destination NATed from WAN.

The easiest solution is split-brain DNS - just set up records/zones on your DNS server and point the external names to the internal IP addresses. Make sure your internal clients use that DNS server (you could block their access to external DNS on the firewall).

Essentially, instead of using the public DNS record, www.website.com => public WAN IP, and destination NATing public WAN IP to, your internal DNS resolves www.website.com directly to No need for NAT at all.

Resolving the external names to public IP addresses requires "hairpinning" on the router/firewall, including destination NAT and usually source NAT for the client. That can cause severe performance penalties (if at all possible) and also hides the client IPs behind the firewall IP. Using split-brain DNS extremely simplifies the setup.

  • Thanks for the very clear answer!! I have DNS forward lookup zone corp.mydomain.com behind the pfSense ( The primary DNS server on pfSense is set to be Can I accomplish the same by updating the hosts file on all work machines in LAN1 with an entry for www.mydomain.com? I tried www.mydomain.com ==> this doesn't change anything, same as the current default functioning. This IP resolves to the EdgeOS interface so when I ask my webpage I get 404 (not found). www.mydomain.com ==> connection timed out, can't even ping this.. Dec 30, 2018 at 10:55
  • I can create a new forward lookup zone for www.mydomain.com and remove NAT from pfSense (though the security will kill me). But how will this help the workstations in LAN1 of Edge, since they can't get to, the WAN interface of pfSense? Dec 30, 2018 at 11:03
  • You could use the hosts files, but they're a pain to maintain. If you ping by name and see the private IP it's working. However, host-related issues are off-topic here. The 404 error probably originates from dNATing port 80 on the outside interface, but not on the inside interface where you might access the pfSense's web console.
    – Zac67
    Dec 30, 2018 at 12:08
  • When I ping www.mydomain.com I get the public static ip and when I trace route, there is only one hop: to the internet service provider public static ip. But as you said, this is what the global DNS resolves. This is not the real physical route from LAN1 workstations to pfSense in LAN2... There is no physical route, the interfaces are separated. Port 80 and 443 are NATed on both the outside Edge route and the pfSense firewall. Dec 31, 2018 at 12:14
  • When you ping www.mydomain.com that resolves to the firewall's public IP, you don't actually ping the website but the firewall. With split-brain DNS you'd see the private IP of your webserver and ping that.
    – Zac67
    Dec 31, 2018 at 12:21

The only solution that worked was the workaround to access the site from the laptop with VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.