Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This should be dead simple but for the life of me, I can't get it working. I must be doing something stupid.

I have a PFsense server with a public IP address. Behind it is three LAN segments:

[ Internet ]  <---> [ pfSense]  
                        +----- ---> (multiple servers)
                        +----- ---> (multiple servers)
                        +----- ---> (multiple machines)

I have a new server with address behind the pfSense server, and I want to give it a public IP. I assumed I would do this with a 1:1 NAT, but no matter what I ahve tried, it's not working. Here's what I did:

  1. In pfSense, I added a Virtual IP to the WAN interface with the new public IP I wanted. The first time, I used an "IP Alias" type.
  2. I added a 1:1 NAT rule with the new public IP as the external subnet, and as the internal subnet.
  3. I added a firewall rule on the WAN interface, protocol TCP, destination, port range HTTP - HTTP. I did the same for another port in the 4000s where I wanted to run SSH.

After doing all of the above, I could not reach the new IP via HTTP, nor could I SSH into the new machine on the alternate SSH port I chose.

I changed the virtual IP to "Proxy ARP" and then to "Other", but neither of those worked either...

Oddly enough, I can SSH to the new IP on port 22, if I run the SSH server on But I can't get to any other ports.

What am I doing wrong here?

share|improve this question
up vote 4 down vote accepted

If you haven't looked at the wiki, that's a good place to start:

I'm pretty sure you had it right the first time. You need to set up an IP alias on your public facing interface. The IP address you choose for this alias will of course need to be legitimately routable (your ISP should have given you some publicly accessible IPs).

Can you get command line access and edit your post to include the entirety of your pf rules (pfctl -s rules)?

share|improve this answer
I'll edit my question and post the requested information tomorrow – Josh May 12 '11 at 23:13
I don't know what I was doing wrong. In the end, I deleted ALL rules related to this 1:1 NAT IP, deleted the 1:1 NAT, updated pfSense, and recreated everything from scratch, and it works now... – Josh May 27 '11 at 0:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.