"
Double NAT + Multi-WAN: Port forward packets logged as PASS on WAN but dropped before reaching internal VLAN
Hi everyone,
We are experiencing a frustrating packet-dropping issue in a cascaded (Double NAT) and Multi-WAN environment.
### Our Topology
1. **WANgate (Edge Firewall):** Has public IP on WAN. Port forwards TCP 9449 to LANgate's WAN IP (`10.X.Y.2`).
2. **LANgate (Internal Firewall):**
- WAN interface IP: `10.X.Y.2` (connected to WANgate's LAN subnet `10.X.Y.0/24`)
- Multi-WAN configured (has another gateway `WAN_SERVER` active)
- Port forwards incoming TCP 9449 to an internal QNAP NAS (`10.A.B.121:443`) on an internal interface (`vlanXX` / `10.A.B.1/21` subnet).
### Environment Details
- **OPNsense Version:** OPNsense 25.10.2_12-amd64
FreeBSD 14.3-RELEASE-p10
OpenSSL 3.0.19
Licensed until 2026-09-29
- **Hardware/Platform:**
Bare-metal Thomas Krenn 2U rack server with Intel NICs
Intel(R) Xeon(R) E-2386G CPU @ 3.50GHz (6 cores, 12 threads)
- **Hardware Offloading:**
Disabled (Checksum, TSO, and LRO are all checked/disabled under Interfaces > Settings)
### The Problem
When testing from an external IP, we can see the packets successfully forwarded from WANgate to LANgate's WAN.
On LANgate's Live View logs:
- We see a `PASS` log for `10.X.Y.1` (WANgate LAN) -> `10.X.Y.2:9449` (LANgate WAN).
- **Crucial Detail:** The log entry has an **empty label**, meaning it doesn't seem to trigger the NAT rule itself, but rather falls through to a generic PASS rule.
When running a Packet Capture on LANgate's internal interface (`vlanXX`) filtering for destination host `10.A.B.121` and port `443`, **absolutely 0 packets** are captured.
### What we have tried so far:
1. Checked QNAP's gateway configuration (it is correctly pointed to LANgate `10.A.B.1` with a `/21` mask).
2. Checked QNAP's internal security settings (Allow all connections is active).
3. Created an Outbound SNAT rule on LANgate (Interface: internal, Source: Any, Destination: QNAP IP, Translation: Interface Address) to prevent asymmetric routing issues, but it didn't help.
4. Created a Source NAT (SNAT) on WANgate's LAN so LANgate sees the source as `10.X.Y.1`, but still no packet reaches the internal VLAN interface.
Since we are using Multi-WAN, we suspect this might be related to state-table routing, `reply-to` behavior, or an issue with how OPNsense processes port forwards with multiple gateways active.
Any ideas on why OPNsense receives the packet on WAN but completely silent-drops it before forwarding it to the internal interface?
Thank you in advance!
Hi everyone,
We are experiencing a frustrating packet-dropping issue in a cascaded (Double NAT) and Multi-WAN environment.
### Our Topology
1. **WANgate (Edge Firewall):** Has public IP on WAN. Port forwards TCP 9449 to LANgate's WAN IP (`10.X.Y.2`).
2. **LANgate (Internal Firewall):**
- WAN interface IP: `10.X.Y.2` (connected to WANgate's LAN subnet `10.X.Y.0/24`)
- Multi-WAN configured (has another gateway `WAN_SERVER` active)
- Port forwards incoming TCP 9449 to an internal QNAP NAS (`10.A.B.121:443`) on an internal interface (`vlanXX` / `10.A.B.1/21` subnet).
### Environment Details
- **OPNsense Version:** OPNsense 25.10.2_12-amd64
FreeBSD 14.3-RELEASE-p10
OpenSSL 3.0.19
Licensed until 2026-09-29
- **Hardware/Platform:**
Bare-metal Thomas Krenn 2U rack server with Intel NICs
Intel(R) Xeon(R) E-2386G CPU @ 3.50GHz (6 cores, 12 threads)
- **Hardware Offloading:**
Disabled (Checksum, TSO, and LRO are all checked/disabled under Interfaces > Settings)
### The Problem
When testing from an external IP, we can see the packets successfully forwarded from WANgate to LANgate's WAN.
On LANgate's Live View logs:
- We see a `PASS` log for `10.X.Y.1` (WANgate LAN) -> `10.X.Y.2:9449` (LANgate WAN).
- **Crucial Detail:** The log entry has an **empty label**, meaning it doesn't seem to trigger the NAT rule itself, but rather falls through to a generic PASS rule.
When running a Packet Capture on LANgate's internal interface (`vlanXX`) filtering for destination host `10.A.B.121` and port `443`, **absolutely 0 packets** are captured.
### What we have tried so far:
1. Checked QNAP's gateway configuration (it is correctly pointed to LANgate `10.A.B.1` with a `/21` mask).
2. Checked QNAP's internal security settings (Allow all connections is active).
3. Created an Outbound SNAT rule on LANgate (Interface: internal, Source: Any, Destination: QNAP IP, Translation: Interface Address) to prevent asymmetric routing issues, but it didn't help.
4. Created a Source NAT (SNAT) on WANgate's LAN so LANgate sees the source as `10.X.Y.1`, but still no packet reaches the internal VLAN interface.
Since we are using Multi-WAN, we suspect this might be related to state-table routing, `reply-to` behavior, or an issue with how OPNsense processes port forwards with multiple gateways active.
Any ideas on why OPNsense receives the packet on WAN but completely silent-drops it before forwarding it to the internal interface?
Thank you in advance!
