I have a situation like in the picture: network topology

I want to add a pfsense router inside an existing subnet and have these possibilities:

  • I want the network to have access to the internet over the router, and access to the network.
  • The be able to port forward to servers inside the network

I set up:

  • interface has gateway set to
  • I put firewall rules on Pfsense that lets all traffic everywhere (TCP, UDP and ICMP). (for testing purposes)
  • Mikrotik has static route to subnet over the

The problem I have is Mikrotik can't traceroute inside the network (it just jumps to pfsense, and timeout after that). Browsers inside the network can't get on the internet. I can connect to the OpenVPN on the pfsense (from the internet), but when connected, I can't access anything except Pfsense. It seems like no traffic is going through Pfsense.

Do I need NAT or not? Do I need static routes (except the Mikrotik one)? I have a feeling I'm missing something, but I don't know what.

  • 2
    You should not have the same network ( on two sides of your Mikrotik. You must change the network used on either side.
    – JFL
    Apr 4, 2023 at 13:25
  • @JFL I might have drawn it wrongly, Mikrotik has a bridge over all of its ports, so it's basically being used like a switch. But the Internet router is port forwarding selected ports to the Mikrotik, and then Mikrotik is forwarding them to the Pfsense.
    – Janjko
    Apr 4, 2023 at 14:42
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67
    Sep 1, 2023 at 17:02

1 Answer 1


A router needs to know where to send traffic, else it will drop the packets with destinations it does not know. Your Internet router will have a default route (matches all destinations) as a route of last resort toward the public Internet, but it needs to know how to reach every internal network.

Routers learn routes in three ways:

  • Directly connected networks
  • Statically configured routes
  • Dynamic routing protocols

Because the networks internal to the pfSense router are not directly connected to either the Internet router nor the MikroTik router, those routers need those networks to be either statically configured to point to the pfSense router, or you need to run a routing protocol so that the routers can exchange routing information.

Do I need NAT or not?

You only use NAT where you must (public<->private or overlapping addressing). You should not use NAT for your internal network because it is unnecessary, and it will cause you problems. You can simply route in your internal network, but all your routers need to know how to reach all your internal networks.

Static routes do not scale, but they may be fine for small sites. Dynamic routing protocols take some configuration, but then you can add and remove networks and they are automatically advertised to all your routers.

  • Thanks, it didn't help me solve the problem, but I got some good tips from you. I'll try to solve it another way.
    – Janjko
    Apr 5, 2023 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.