Nat – pfsense nat between two internal ip

nat;pfsense

TL;DR
What technology should I use to translate an internal address (192.168.1.10) to another internal address (192.168.1.11)? So that when I access the first I get redirected to the other?

Long Story
I have a pbx box that I need to move from one location to another. The ip of the pbx box is 192.168.1.160 and all the phones points to that address.
When the pbx box is moved it will reside at 192.168.2.160.
As it is now the two different subnets are connected by a site-to-site connection which means that you can access 192.168.2.0/24 from within 192.168.1.0/24 no problem. (That is why I mentioned them earlier to both be internal)

My problem is that the move will take some time, and I will have to manually configure all the phones for the new location 192.168.2.160. Hence I need to split this task up in two.

day one/ move server, nat(or what not) from address a to address b.
day two/ configure phones manually one by one, then remove natting(or
what not)

In this way as I see it no one will ever be affected by the move

But my question is: is it a nat rule that i need to apply.

The setup:

192.168.2.0/24 -> pfsense -> WAN(site-to-site) <-pfsense <- 192.168.1.0/24

Best Answer

Assuming:

pbx -> 192.168.2.0/24 -> pfsense1 -> WAN(site-to-site) <-pfsense2 <- 192.168.1.0/24 <- phones

Here's one way you could do this.

Prep:

Add route in pfsense1 for 192.168.1.0/24 using either pfsense2 WAN IP or VPN tunnel for gateway.
Add firewall rule in pfsense1 to allow necessary incoming ports FROM 192.168.1.0/24
Add route in pfsense2 for 192.168.2.0/24 using either pfsense1 WAN IP or VPN tunnel for gateway.
Add firewall rule in pfsense2 to allow necessary incoming ports FROM 192.168.2.0/24

Changeover:

Change config on phones to look for PBX on 192.168.2.160.
Change config on phones to use pfsense2 as default gateway.
Change pbx to ip 192.168.2.160.
Change pbx default gateway to pfsense1.

Keep in mind that you need to know what ports the phones use, and you have to unblock those in the firewalls. Also keep in mind that depending on your hardware you may lose some functionality in the phones when working across VPN tunnels / WAN links. For example, 3com NBX's use multicast for time updates, status lights, and paging. Some hardware will simply not support multicast forwarding across a VPN channel - which means these features won't work on remote phones.

I would recommend setting up some kind of computer at the remote site, and then setting up the configs in the firewalls. Verify site-to-site routing/connectivity before continuing with the phones.

Route tables

First edit the /etc/iproute2/rt_tables to add a map between route table numbers and ISP names

...
10 ISP1
20 ISP2
...

So table 10 and 20 is for ISP1 and ISP2, respectively. I need to populate these tables with routes from main table with this code snippet (which I have taken from hxxp://linux-ip.net/html/adv-multi-internet.html)

ip route show table main | grep -Ev '^default' \
   | while read ROUTE ; do
     ip route add table ISP1 $ROUTE
done

And add default gateway to ISP1 through that ISP1's gateway:

ip route add default via 192.168.1.2 table ISP1

Do the same for ISP2

So now I have 2 route tables, 1 for each ISP.

Iptables

OK now I use iptables to evenly distribute packets to each route tables. More info on how this work can be found here (http://www.diegolima.org/wordpress/?p=36) and here (http://home.regit.org/?page_id=7)

# iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
# iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
# iptables -t mangle -A PREROUTING -j MARK --set-mark 10
# iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.5 -j MARK --set-mark 20
# iptables -t mangle -A PREROUTING -j CONNMARK --save-mark

NAT

Well NAT is easy:

# iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE

Nat – pfSense NAT failing – TCP connection built, no traffic

NAT Port Forwards in pfSense also require a corresponding firewall rule. I would double check your firewall rules, and also determine if the connection is failing at the pfSense instance or on the RDP destination VM by trting to RDP to the VM internally.

Best Answer

Related Solutions

Linux – Load Balancing and NAT-ing Multiple ISP Connections

Route tables

Iptables

NAT

Nat – pfSense NAT failing – TCP connection built, no traffic

Related Topic