Some issues configuring OPNSense w/ PPPoE+STATIC IP Block+Internet Conectivity.

[fbeye]

Hi there

I’ve used OPNS a while back and had 0 issues with it but my layout was quite simple. At that same time I was using Cisco ISR + FTD (NGFW) for my more complicated setup but wanted to move it all over to just OPN.
I won’t get to crazy details of my setup but will mention the most basic needs;

I have 5 usable static ips, each static wan ip has its own network. I.E. 207.108.x177 is 192.168.1.0, 207.108.x 178 is 192.160.2.0 and so on. Obviously I need NAT for WAN to LAN (ip) direction  for specific ip’s and port services etc but also want a NAT for the WAN to NETWORK as a whole.
Just curious if this is possible.
So, I’d need NAT x.x.x.177 is 192.168.1.0 but then NAT x.x.x.177 Port 443 to let’s say 192.168.1.443 for NGINX.

[Patrick M. Hausen]

Of course this is perfectly possible with OPNsense. Not at all complicated.

[newsense]

...let’s say 192.168.1.443 for NGINX

Need to be a forum subscriber on the Vanity+ yearly plan to use vanity IPs in OPNsense I'm afraid.

[fbeye]

I do not understand your meaning, vanity IP’s? I just mean that if I were to connect to WAN https x.x.x.177 it would forward to LAN 192.168.1.443:443, so essentially I wanna run a https server. This would be part of a pay subscription?

[Patrick M. Hausen]

192.168.1.443 is not a valid IP address ...

[fbeye]

192.168.1.43:443 I am sorry, yeah I just got giddy with typing you are correct. Also NGINX would be running on a Docker container on that IP.

[fbeye]

I do not understand your meaning, vanity IP’s? I just mean that if I were to connect to WAN https x.x.x.177 it would forward to LAN 192.168.1.443:443, so essentially I wanna run a https server. This would be part of a pay subscription?

Oh wow I am an idiot. You were referring to the 192.168.1.443, which I was mistaken in saying, I am slow today. Alright cool I’ll look into getting this all done. Thanks all.

[fbeye]

BUMP

[fbeye]

I added IP Aliases, also WAN set for PPPoE and grabs default IP/Gateway x.x.x.182;

x.x.x.177
x.x.x.178
x.x.x.179
x.x.x.180
x.x.x.181
x.x.x.182 [Default WAN IP]

NAT One-To-One BiNAT, Each WAN IP translates to it's own LAN Network;

x.x.x.177 NAT 192.168.1.0
x.x.x.178 NAT 192.168.2.0
x.x.x.179 NAT 192.168.3.0
x.x.x.180 NAT 192.168.4.0
x.x.x.181 NAT 192.168.5.0
x.x.x.182 NAT 192.168.6.0

Will Outbound NAT will be negotiated via Hybrid NAT rules/ BiNAT setup?
Is there a way to specify outgoing as a whole, I.E. 'anything' on 192.168.1.0
outbounds x.x.x.177, 192.168.2.0 outbounds x.x.x.178 and so on? I assume I would
need to make those Outbound entries... to email servers and http servers.

I will assume that I give LAN Interface on OPNSense an IP of 172.16.1.1
I create 6 Static Routes to the SG350XG Networks using 172.16.1.2 [SG GE 1/1 Interface IP]
as the Gateway.
This way anything Incoming on a specific WAN IP will be NAT'd to the specific LAN Network
which is forwarded to the SG350XG via the Static Routes for the Networks
   192.168.1.0 255.255.255.0 172.16.1.2
   192.168.2.0 255.255.255.0 172.16.1.2
And so on.

Do I need to set up a Gateway at all on the OPNSense?   

[fbeye]

Yeah, that did not work. Like, everything "worked" except Internet access. Only thing I did not ADD were any OUTGOING NAT rules, but I assumed I did not need. Apparently I did. I tried doing auto nat and hybrid.
Through the OPNSense to the SG350XG, I could connect to all LAN devices on each Network, all was fine.. But nothing outgoing.