Next year, if I have the money for it, I want to get a dedicated server (either from Hetzner or OVH) and some IPs (maybe like 16 IPs). The server will have Proxmox and VMs will get their network connection through a pfSense VM (some servers that don't need their own public IP will be behind a normal NAT using the pfSense WAN IP, and then 1:1 NAT for those that need a public IP). I wanted to see if I could figure out how to set this up now, just so I know what to do for when I get the server.

So I set up some VMs in VirtualBox.


The idea with this setup was that pfSense-01 would be like the hosting provider having some IPs (in this case a /25) and are routing a /28 to me. Ubuntu-03 would be a server on their network (I set it up to test if 1:1 NAT was working; it has a web server which returns the IP address of each request).

But there's an issue:

  • ubuntu-01 can ping ubuntu-02 on both IPs
  • ubuntu-02 can ping ubuntu-01
  • ubuntu-01 and ubuntu-02 can ping pfSense-01 and pfSense-02
  • pfSense-01 can ping ubuntu-02 on the 1:1 NAT IP
  • ubuntu-01 can ping ubuntu-03
  • All good until here, but here's where the issue is:
  • ubuntu-02 cannot ping ubuntu-03
  • ubuntu-03 cannot ping ubuntu-02 on the 1:1 NAT IP

All VMs can access the internet. I've been managing pfSense through ubuntu-01, which is a desktop VM.

I read online about NAT reflection, so have set the following settings in an attempt to fix this issue:

  • NAT reflection mode: Pure NAT
  • NAT reflection for 1:1 NAT: checked
  • Enable automatic outbound NAT for reflection: checked

All interfaces have the block private and bogon networks option unchecked.

The firewall is as open as it can be, with both WAN and LAN being set to allow connections from any source to any destination. This will be changed to more secure settings once I get 1:1 NAT working.

If I access the web server on ubuntu-03 from ubuntu-01, it works. it works

But trying to access that same page from ubuntu-02 (the one with 1:1 NAT) fails

nicholis@testnet-ubuntu-02:~$ curl -v --connect-timeout 10
* Rebuilt URL to:
*   Trying
* Connection timed out after 10000 milliseconds
* stopped the pause stream!
* Closing connection 0
curl: (28) Connection timed out after 10000 milliseconds

I asked the owner of a hosting company for help in fixing this (as they also use pfSense for their network) and he wasn't able to figure out why 1:1 NAT doesn't work in my setup.

So now I'm asking here: how do I get 1:1 NAT working?

  • Please, never use an image for text. Simply copy the text and paste it into the question and use the Preformatted-text option ({}). We need to see the full (sanitized) configuration. Please edit your question to include that. – Ron Maupin Apr 25 '20 at 17:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 16 '20 at 23:18

The issue is your LAN subnet overlaps with the virtual-IPs you are using.

  • ubuntu-03 is attached to PFsense-01's LAN interface with address
  • PFSense-02 is set to forward virtual IP to
  • For ubuntu-03, the address is within ubuntu-03's local layer 2 network and won't address the traffic to PFsense-03 as it's doing ARP lookups for it on it's network.

To fix you could add the same static route for via on Ubuntu-03 but it's ugly. I've seen on Windows ARP lookups still occur and it gets confused whether to use the directly connected route or via the static route.

A better approach is to do all NAT in pfSense-01 or ideally not use NAT at all. If your internet provides 16 IPs as you suggest, that means your provider has a route for a /28 subnet via your WAN IP. For example

You can split the block and allocate to a LAN interface on PFSense-01, and to the LAN interface on PFSense-02.

To conserve IP addresses you can assign private IP addresses from outside this range to new interfaces for routing between the PFSense vms and add a route for to PFSense-01 via the address for PFSense-02.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.