This should be dead simple but for the life of me, I can't get it working. I must be doing something stupid.

I have a PFsense server with a public IP address. Behind it is three LAN segments:

[ Internet ]  <---> [ pfSense]  
                        +----- ---> (multiple servers)
                        +----- ---> (multiple servers)
                        +----- ---> (multiple machines)

I have a new server with address behind the pfSense server, and I want to give it a public IP. I assumed I would do this with a 1:1 NAT, but no matter what I ahve tried, it's not working. Here's what I did:

  1. In pfSense, I added a Virtual IP to the WAN interface with the new public IP I wanted. The first time, I used an "IP Alias" type.
  2. I added a 1:1 NAT rule with the new public IP as the external subnet, and as the internal subnet.
  3. I added a firewall rule on the WAN interface, protocol TCP, destination, port range HTTP - HTTP. I did the same for another port in the 4000s where I wanted to run SSH.

After doing all of the above, I could not reach the new IP via HTTP, nor could I SSH into the new machine on the alternate SSH port I chose.

I changed the virtual IP to "Proxy ARP" and then to "Other", but neither of those worked either...

Oddly enough, I can SSH to the new IP on port 22, if I run the SSH server on But I can't get to any other ports.

What am I doing wrong here?


If you haven't looked at the wiki, that's a good place to start:

I'm pretty sure you had it right the first time. You need to set up an IP alias on your public facing interface. The IP address you choose for this alias will of course need to be legitimately routable (your ISP should have given you some publicly accessible IPs).

Can you get command line access and edit your post to include the entirety of your pf rules (pfctl -s rules)?

  • I'll edit my question and post the requested information tomorrow
    – Josh
    May 12 '11 at 23:13
  • I don't know what I was doing wrong. In the end, I deleted ALL rules related to this 1:1 NAT IP, deleted the 1:1 NAT, updated pfSense, and recreated everything from scratch, and it works now...
    – Josh
    May 27 '11 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.