Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been banging my head against the wall on this for a couple of days now - thought I had tried everything, but obviously not...

I have the following networking scenario...

ISPs Router Edge (
My Cisco Router WAN (
My Cisco Router LAN (
My Office GW/NAT/FW WAN (
My Office GW/NAT/FW LAN (

This all works fine - but I am trying to replace the Cisco with a pfSense box. I have ip_forward set to 1 and the following in the routing table:

DESTINATION       GW            FLAGS     INTERFACE           
default    UGS       xl0 (WAN)    *             U         xl0 (WAN)       *             UHS       lo0 *             U         xl1 (LAN)    *             UHS       lo0         *             UH        lo0

From my 10.10.111.x network I can ping fine, but when I try (or any other public address) it fails - it seems that I cannot get the traffic to pick up the default route ?? Maybe it is finding the default route, but something else is wrong - but I really don't know what to check next (linux novice)

I have checked that the firewall is off (also tried on with everything wide open), NAT is off...

Nothing seems to work - any pointers much appreciated !!

Thanks .. Ken

share|improve this question

If NAT is off, by default a packet from a private network (eg your 10.x.x.x network) should be dropped as it is not routable. This is likely what your ISP is doing. If they aren't dropping the packets, their networks still wouldn't know where to send the traffic back to.

You will need to enable NAT so the packet appears to be coming from the address; then your ISP (and the rest of the world) will know how to route the packet back to you.

share|improve this answer
Thanks Chris, but I forgot to mention that the office NAT/FW/GW is doing the NAT from 10.x.x.x to our public IP (obfuscated IPs), so by the time it gets to pfSense it it purely routing that is needed (I think ??) – KennetRunner Oct 13 '11 at 22:30
@KenHughes, maybe the Cisco has BGP and you forgot it on the pfSense. Capture the packets going to/from the ISP and you will figure out the problem. – Pentium100 Feb 16 '14 at 21:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.