pfSense 1:1 NAT Not Working

Question

Next year, if I have the money for it, I want to get a dedicated server (either from Hetzner or OVH) and some IPs (maybe like 16 IPs). The server will have Proxmox and VMs will get their network connection through a pfSense VM (some servers that don't need their own public IP will be behind a normal NAT using the pfSense WAN IP, and then 1:1 NAT for those that need a public IP). I wanted to see if I could figure out how to set this up now, just so I know what to do for when I get the server.

So I set up some VMs in VirtualBox.

The idea with this setup was that pfSense-01 would be like the hosting provider having some IPs (in this case a /25) and are routing a /28 to me. Ubuntu-03 would be a server on their network (I set it up to test if 1:1 NAT was working; it has a web server which returns the IP address of each request).

But there's an issue:

• ubuntu-01 can ping ubuntu-02 on both IPs
• ubuntu-02 can ping ubuntu-01
• ubuntu-01 and ubuntu-02 can ping pfSense-01 and pfSense-02
• pfSense-01 can ping ubuntu-02 on the 1:1 NAT IP
• ubuntu-01 can ping ubuntu-03
• All good until here, but here's where the issue is:
• ubuntu-02 cannot ping ubuntu-03
• ubuntu-03 cannot ping ubuntu-02 on the 1:1 NAT IP

All VMs can access the internet. I've been managing pfSense through ubuntu-01, which is a desktop VM.

I read online about NAT reflection, so have set the following settings in an attempt to fix this issue:

• NAT reflection mode: Pure NAT
• NAT reflection for 1:1 NAT: checked
• Enable automatic outbound NAT for reflection: checked

All interfaces have the block private and bogon networks option unchecked.

The firewall is as open as it can be, with both WAN and LAN being set to allow connections from any source to any destination. This will be changed to more secure settings once I get 1:1 NAT working.

If I access the web server on ubuntu-03 from ubuntu-01, it works.

But trying to access that same page from ubuntu-02 (the one with 1:1 NAT) fails

nicholis@testnet-ubuntu-02:~$ curl -v --connect-timeout 10 http://10.33.19.137:8080
* Rebuilt URL to: http://10.33.19.137:8080/
*   Trying 10.33.19.137...
* TCP_NODELAY set
* Connection timed out after 10000 milliseconds
* stopped the pause stream!
* Closing connection 0
curl: (28) Connection timed out after 10000 milliseconds

I asked the owner of a hosting company for help in fixing this (as they also use pfSense for their network) and he wasn't able to figure out why 1:1 NAT doesn't work in my setup.

So now I'm asking here: how do I get 1:1 NAT working?

Answer 1

The issue is your LAN subnet overlaps with the virtual-IPs you are using.

• ubuntu-03 is attached to PFsense-01's LAN interface with address 10.33.19.137/25
• PFSense-02 is set to forward virtual IP 10.33.19.193/28 to 100.64.13.12.
• For ubuntu-03, the address 10.33.19.193 is within ubuntu-03's local layer 2 network and won't address the traffic to PFsense-03 as it's doing ARP lookups for it on it's network.

To fix you could add the same static route for 10.33.19.192/28 via 10.33.19.134 on Ubuntu-03 but it's ugly. I've seen on Windows ARP lookups still occur and it gets confused whether to use the directly connected route or via the static route.

A better approach is to do all NAT in pfSense-01 or ideally not use NAT at all. If your internet provides 16 IPs as you suggest, that means your provider has a route for a /28 subnet via your WAN IP. For example 192.168.0.1/28.

You can split the block and allocate 192.168.0.1/29 to a LAN interface on PFSense-01, and 192.168.0.9/29 to the LAN interface on PFSense-02.

To conserve IP addresses you can assign private IP addresses from outside this range to new interfaces for routing between the PFSense vms and add a route for 192.168.0.9/29 to PFSense-01 via the address for PFSense-02.