NATing an internal (LAN zone) address to a WAN zone address

Started by engelant, June 07, 2021, 05:07:24 PM

Previous topic - Next topic
So in my home I've got a Fritz!Box and I changed my network setup for my home network to be directly handled by my Fritz!Box.
This way I can restart/update/shut down my Server with OPNsense, without loosing my basic network.

My main network is something like 192.168.4.0/22, with 192.168.7.254 being my Fritz!Box as a default GW and DNS Server, 192.168.7.251 my OPNsense#1, 192.168.7.253 the CARP vIP and 192.168.7.252 reserved for a secondary OPNsense.

On my OPNsense I used to have a transfer net (10.0.200.0/29) with a CARP vIP of 10.0.200.1, which was my WAN transfer zone (with the Fritz!Box having 10.0.200.4).

Now while I can add routes in the Fritz!Box I can not add a port forward/exposed host for any IP outside of the Fritz!Box range (192.168.4.0/22). This is a know "won't fix" limitation of the Fritz!Box ever since they switched to their new, modern interface.
I was hoping I could add a vIP of 192.168.7.250 to OPNsense and NAT everything that comes in to 10.0.200.1.
This way I would have my WAN related rules on my old and seperated Interface rather than having to mix this in with my LAN zone.

So I created a test NAT for 10.0.200.1:80 to point at some test HTTP host. If I access 10.0.200.1:80 from my PC (inside the 192.168.4.0/22 net), I get a response as expected.
Now with the vIP 192.168.7.250 I created a NAT rule (any -> 10.0.200.1) and accessing 192.168.7.250:80 won't work.
Also I tried to set up 1to1 NAT for the same purpose and it also doesn't seem to work.

Now my question is: am I completely misunderstanding something and this can't work, is this a known limitation (maybe not yet known?) or is my configuration just broken and it should actually work?