Double NAT + Multi-WAN: Port forward packets logged as PASS on WAN but dropped before reaching internal VLAN
Hi everyone,
We are experiencing a frustrating packet-dropping issue in a cascaded (Double NAT) and Multi-WAN environment.
### Our Topology
1. **WANgate (Edge Firewall):** Has public IP on WAN. Port forwards TCP 9449 to LANgate's WAN IP (`10.X.Y.2`).
2. **LANgate (Internal Firewall):**
- WAN interface IP: `10.X.Y.2` (connected to WANgate's LAN subnet `10.X.Y.0/24`)
- Multi-WAN configured (has another gateway `WAN_SERVER` active)
- Port forwards incoming TCP 9449 to an internal QNAP NAS (`10.A.B.121:443`) on an internal interface (`vlanXX` / `10.A.B.1/21` subnet).
### Environment Details
- **OPNsense Version:** OPNsense 25.10.2_12-amd64
FreeBSD 14.3-RELEASE-p10
OpenSSL 3.0.19
Licensed until 2026-09-29
- **Hardware/Platform:**
Bare-metal Thomas Krenn 2U rack server with Intel NICs
Intel(R) Xeon(R) E-2386G CPU @ 3.50GHz (6 cores, 12 threads)
- **Hardware Offloading:**
Disabled (Checksum, TSO, and LRO are all checked/disabled under Interfaces > Settings)
### The Problem
When testing from an external IP, we can see the packets successfully forwarded from WANgate to LANgate's WAN.
On LANgate's Live View logs:
- We see a `PASS` log for `10.X.Y.1` (WANgate LAN) -> `10.X.Y.2:9449` (LANgate WAN).
- **Crucial Detail:** The log entry has an **empty label**, meaning it doesn't seem to trigger the NAT rule itself, but rather falls through to a generic PASS rule.
When running a Packet Capture on LANgate's internal interface (`vlanXX`) filtering for destination host `10.A.B.121` and port `443`, **absolutely 0 packets** are captured.
### What we have tried so far:
1. Checked QNAP's gateway configuration (it is correctly pointed to LANgate `10.A.B.1` with a `/21` mask).
2. Checked QNAP's internal security settings (Allow all connections is active).
3. Created an Outbound SNAT rule on LANgate (Interface: internal, Source: Any, Destination: QNAP IP, Translation: Interface Address) to prevent asymmetric routing issues, but it didn't help.
4. Created a Source NAT (SNAT) on WANgate's LAN so LANgate sees the source as `10.X.Y.1`, but still no packet reaches the internal VLAN interface.
Since we are using Multi-WAN, we suspect this might be related to state-table routing, `reply-to` behavior, or an issue with how OPNsense processes port forwards with multiple gateways active.
Any ideas on why OPNsense receives the packet on WAN but completely silent-drops it before forwarding it to the internal interface?
Thank you in advance!
Do you really think it's productive to post the same question at least four times in three languages? Two times in English in different subforums as far as I can see?
You will get part of answers here, part of answers there, instead of a single coherent thread. I recommend you delete all postings but one.
Quote from: Patrick M. Hausen on Today at 09:55:07 AMDo you really think it's productive to post the same question at least four times in three languages? Two times in English in different subforums as far as I can see?
You will get part of answers here, part of answers there, instead of a single coherent thread. I recommend you delete all postings but one.
Hi Patrick,
You are absolutely right, and I sincerely apologize for the spammy behavior. I got a bit panicked trying to find a solution to this urgent production issue, but I completely agree that having a single coherent thread is much better.
I have deleted the other threads as per your recommendation. Let's keep only one thread active.
Regarding our issue, we have a Double NAT + Multi-WAN setup with a Thomas Krenn server running OPNsense Business. We are seeing a PASS log on the internal WAN interface but absolutely 0 packets are reaching the internal VLAN interface.
I would highly appreciate any guidance you or the community could provide. Again, sorry for the inconvenience!
SSH to LANgate and try
telnet 10.150.70.121 8083
Quote from: GG on Today at 10:02:09 AMI got a bit panicked trying to find a solution to this urgent production issue,
Then you need a paid license for OPNsense with the support that comes along with it :)
Another option is to hire a local specialized company to help you out.
Quote from: GG on Today at 09:39:48 AMOn LANgate's Live View logs:
- We see a `PASS` log for `10.X.Y.1` (WANgate LAN) -> `10.X.Y.2:9449` (LANgate WAN).
You see 10.X.Y.1 as source address on LANgate?
This would mean, that the outer firewall does masquerading on the forwarded traffic.
If this is desired, you have to go to the WAN interface settings on LANgate and remove the check at "Block private networks".
But I'd rather recommend to disable the masquerading (oubound NAT) on the outer firewall.