Next year, if I have the money for it, I want to get a dedicated server (either from Hetzner or OVH) and some IPs (maybe like 16 IPs). The server will have Proxmox and VMs will get their network connection through a pfSense VM (some servers that don't need their own public IP will be behind a normal NAT using the pfSense WAN IP, and then 1:1 NAT for those that need a public IP). I wanted to see if I could figure out how to set this up now, just so I know what to do for when I get the server.
So I set up some VMs in VirtualBox.
The idea with this setup was that pfSense-01 would be like the hosting provider having some IPs (in this case a /25) and are routing a /28 to me. Ubuntu-03 would be a server on their network (I set it up to test if 1:1 NAT was working; it has a web server which returns the IP address of each request).
But there's an issue:
- ubuntu-01 can ping ubuntu-02 on both IPs
- ubuntu-02 can ping ubuntu-01
- ubuntu-01 and ubuntu-02 can ping pfSense-01 and pfSense-02
- pfSense-01 can ping ubuntu-02 on the 1:1 NAT IP
- ubuntu-01 can ping ubuntu-03
- All good until here, but here's where the issue is:
- ubuntu-02 cannot ping ubuntu-03
- ubuntu-03 cannot ping ubuntu-02 on the 1:1 NAT IP
All VMs can access the internet. I've been managing pfSense through ubuntu-01, which is a desktop VM.
I read online about NAT reflection, so have set the following settings in an attempt to fix this issue:
- NAT reflection mode: Pure NAT
- NAT reflection for 1:1 NAT: checked
- Enable automatic outbound NAT for reflection: checked
All interfaces have the block private and bogon networks option unchecked.
The firewall is as open as it can be, with both WAN and LAN being set to allow connections from any source to any destination. This will be changed to more secure settings once I get 1:1 NAT working.
If I access the web server on ubuntu-03 from ubuntu-01, it works.
But trying to access that same page from ubuntu-02 (the one with 1:1 NAT) fails
nicholis@testnet-ubuntu-02:~$ curl -v --connect-timeout 10 http://10.33.19.137:8080 * Rebuilt URL to: http://10.33.19.137:8080/ * Trying 10.33.19.137... * TCP_NODELAY set * Connection timed out after 10000 milliseconds * stopped the pause stream! * Closing connection 0 curl: (28) Connection timed out after 10000 milliseconds
I asked the owner of a hosting company for help in fixing this (as they also use pfSense for their network) and he wasn't able to figure out why 1:1 NAT doesn't work in my setup.
So now I'm asking here: how do I get 1:1 NAT working?