Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

How do I set up NAT on a second gateway router which isn't a default gateway?

Posted on 2013-01-23
6
Medium Priority
?
271 Views
Last Modified: 2014-03-17
Here is my current setup
|----------|
| Router 1 |---|
|----------|   |     |-----|   |--------|
               +-----| Lan |---| Server |
               |     |-----|   |--------|
|----------|   |
| Router 2 |---|
|----------|

Open in new window


I want to be able to send traffic from the internet coming in on Router 2's public IP to the Server's private IP.
Router 2 is a pfSense router, Router 1 is a simple iptables router. I have set up NAT Port Forwarding on Router 2, but the server is trying to respond to the request via Router 1 because Router 1 is the default router.

How do I hide the IP address that is coming in from the internet so the server will respond through Router 2?
0
Comment
Question by:OAC Technology
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 10

Expert Comment

by:ddiazp
ID: 38812451
I don't think NAT is a viable option in your scenario; but perhaps you applied NAT at the wrong place?; you should be creating a NAT rule on R2's inside interface. The problem with this is that this will undoubtedly affect other systems using Router2.

I'd suggest looking at the server's routing table and perhaps making the modifications there if possible.

How many interfaces does your server have?
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 38814608
My server has one interface, and both routers are on the same subnet, and can the server can access both routers. When someone connects I see it show up in netstat on the server, but since the server attempts to respond to their public IP it goes through the wrong router. Is there a way to make pfSense dynamically keep track of connections and hide the public IP of requesters so the server responds directly to the router?
0
 
LVL 10

Accepted Solution

by:
ddiazp earned 2000 total points
ID: 38816895
How about this?:

Go to "firewall --> NAT --> inbound".
Enable manual inbound rule generation.
Create a new rule with:

Interface: WAN/LAN, Source: any, Source-port: any, Destination: Server, Destination-port: service_on_server_or_any, translation: interface address.
0
Looking for a new Web Host?

Lunarpages' assortment of hosting products and solutions ensure a perfect fit for anyone looking to get their vision or products to market. Our award winning customer support and 30-day money back guarantee show the pride we take in being the industry's premier MSP.

 
LVL 2

Author Comment

by:OAC Technology
ID: 38818773
Thanks ddiazp, I tried that but it doesn't seem to actually be translating. Here's what iptstate returns.

                              IPTables - State Top
Version: 1.4          Sort: SrcIP           s to change sorting
Filters:   Source: <my public ip>
Source                  Destination             Proto   State        TTL
<my public ip>:20415       <server private ip>:22            tcp     SYN_RECV       0:00:53

Open in new window

0
 
LVL 10

Expert Comment

by:ddiazp
ID: 38819584
Can you run wireshark or tcpdump, etc. on the server and try to see how this request looks like?

What does pfctl -s nat show?

or Diagnose->States?
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 38836699
The server is receiving the request just fine, but it sees the public ip of the requester, and then due to its routing table, it tries getting sent back out using the other router, but because that's on a different IP address, the requester doesn't listen to the response.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question