Looking for why your pfSense NAT reflection is not working? We can help you with it.

pfSense NAT reflection allows users to access external service from the internal network using external IP.

At Bobcares, we often get requests to fix pfSense errors, as a part of our Server Management Services.

Today, let’s see how our Support Engineers fix this error.

What is NAT reflection in pfSense?

Have you ever felt the need to access external services using the Public IP from an internal network?

pfSense makes this possible by using NAT reflection. Hence, it seems like the user in on the Internet. Even if pfSense supports NAT reflection for some environments requires split DNS for the same.

How to configure NAT reflection pfSense?

Now let’s see how our Support Engineers configure NAT reflection.

For enabling NAT reflection globally, we navigate as System >> Advanced, Firewall & NAT. And we edit the Network Address Translation section.

For configuring NAT reflection we select the appropriate option. And this Network Address Translation window appears as,

Finally, we click Save to activate the options.

Split DNS – An alternative way

In split DNS the internal and external client resolve to different hostnames. Hence, it allows retaining the original IP. And at the same time avoid looping of internal traffic through the firewall.

We usually configure it through DNS Forwarder or Resolver in pfSense. But for this to work the IP address of the pfSense router should be the same as that of the primary DNS server.

Troubleshooting and fixing NAT reflection

So let’s see when does NAT reflection do not work. Mostly improper NAT forwarding can cause errors in NAT reflection.

So whenever customers approach us with this error, our Support Engineers check the NAT port forwarding.

Let’s take an instance where a user forwarded port 80. Here NAT reflection does not work as the connection from the external network seems to come from the internal network.

Hence, to fix this we change the NAT Port Forward and change the External Address to Interface Address. By default, this option will be any.

Similarly, NAT reflection works for single port forwards that too in a range of fewer than 500 ports. Additionally, it works only for TCP connections.

So whenever our customers are getting an error on NAT reflection we check all these and fix it for our customers.

[Need assistance in fixing pfSense errors? – We can help you.]

Conclusion

In short, pfSense NAT reflection not working occurs due to improper NAT port forward. Additionally, NAT reflection works only for TCP connection. Today, we saw how our Support Engineers set it up and troubleshoot the related errors.