I'm trying to figure out how to configure RRAS in order to allow my PfSense router to access a downstream routed network.

The Windows RRAS router is connected to a port on the PfSense router. I can ping Windows RRAS router on the WAN IP from PfSense router (from to

I can also ping between clients and I can ping from clients 24.0.0.x to PfSense Router

I set up a static route in PfSense router to route traffic through

When attempting ping from to any 24.0.0.x (including Windows RRAS LAN IP), Wireshark on is showing that ICMP packets are inbound on the WAN interface, however it is showing (no response found!) at the end, and RRAS is showing an increase in count of the Inbound Packets Rejected. No ping response is shown on

RRAS NAT is enabled on WAN interface.

Any help would be greatly appreciated! I'm assuming the problem lies in RRAS configuration because the packets reach RRAS but are not routed properly.

Duplicate of https://superuser.com/questions/1318356/routing-between-2-routers-with-nat-rras

enter image description here

  • Inbound Packets Rejected sounds like a firewall problem, not a routing problem. As evidenced by your ping from a client machine to pfSense, routing is in fact working correctly. – joeqwerty Apr 30 '18 at 12:58
  • 1
    Is there a reason for the NATting on the RRAS box? I suspect this is why your pings from pfSense don't get through - they are hitting the outside interface of the NAT and there is no mapping to an inside client. Whereas for the outbound ping the RRAS server NATs the client IP to and records a mapping so that the reply is translated back through. – Mintra Apr 30 '18 at 13:05
  • @joeqwerty Firewall is turned off completely – Theveloper Apr 30 '18 at 13:09
  • @Mintra NATing on RRAS is in place so that the clients can access WAN / Internet. I suspect that may be the case as well. Is there anything I can do in order to prevent this from happening while maintaining access to the internet within the RRAS LAN? – Theveloper Apr 30 '18 at 13:11
  • Try to NAT on the pfSense box instead of RRAS. RRAS itself should be able to just route between your LAN ( and WAN ( networks. Note that the addressing you are using for LAN is not a great practice - that is actually public address space belonging to Comcast and you may get problems routing to some of their stuff on the actual internet (your hosts will consider it local and not send traffic to the router). – Mintra May 2 '18 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.