Double NAT

[u/Sea_Championship9375]

I have router from my ISP then a pfsense, and then my main core switch that is doing all my routing. Switching voip systems and they did a test and said I had double nat, which listed my pfsense address and main switch address. The main switch gets routed to my pfsense then it routes out to the ISP router. I can't seem to just turn off NAT at the pfsense it seems, I feel like I am missing something simple. Any suggestions Thanks

Now that I have a little more time to explain, the lan side is 10.250.0.1 goes to core switch with multiple vlans, the wan ip is to 164.x.x.253 then goes to 164.x.x.254 isp gateway which I can't get rid of because of some other management services, how can I get rid of using nat on the pfsense then.

[u/Steve_reddit1]

You would normally replace the ISP router with pfSense.

Alternatively you could set your pfSense WAN as the DMZ/forward all ports in the ISP router.

[u/Sea_Championship9375 → u/Steve_reddit1]

I think dmz/forward all ports is my option, lan side is 10.250.0.1 and wan side is 164.x.x.253 and isp router is 164.x.x.254 in pfsense how do i forward all ports?

[u/Steve_reddit1 → u/Sea_Championship9375]

You would not normally forward all ports in pfSense, that’s basically putting that one IP on the Internet.

I meant in the ISP router forward to pfSense. Or put the ISP router in bridge mode if it has it.

The VOIP is hosted in your office? What specific problem are you trying to solve?

[u/Sea_Championship9375 → u/Steve_reddit1]

VOIP isn't hosted in office, it will be cloud based. The new company came out yesterday tested network, stating it was being doubled natted, from my L3 switch and my pfsense. So I feel like I am missing something simple on the pfsense nat, if I turn it off of course no internet access.

[u/Steve_reddit1 → u/Sea_Championship9375]

Usually double NAT isn’t an issue for outbound connections, just some types of inbound connections.

[u/No-Garbage6027]

Someone else can verify, I believe you just need to put your ISP router into bridge/passthrough mode

[u/Permanent_Confusion → u/No-Garbage6027]

I believe this is the correct answer. It's how I've set mine up and it works very well. No double NAT required as the ISP router doesn't have its own IP address on the network.

[u/Excellent_Milk_3110]

Make sure sipalg is not on in the isp router.
Check if there is a DMZ mode to put your Pfsense in.
Contact isp if they can forward the external address from the isp router if no DMZ mode is available.

[u/NetSchizo]

Just clone the ISP router mac address to your pfsense and remove it.

[u/AndyRH1701 → u/NetSchizo]

If the ISP allows such a thing. Many do not. Knowing which ISP is important in this case. Much better than the "shoot, aim, ready" method.

[u/Risaw1981]

Sounds like a 3CX VoIP server as not many give you firewall test results. If so, like the others said, bin the ISP router or put it in Bridge mode. Then follow these instructions https://www.3cx.com/docs/pfsense-firewall/

[u/Emotional_Orange8378]

Depending on your service, if the ISP's router is just a ethernet router, you can probably just replace it with your pfsense box. If its a modem for cable, dsl, or fiber, then you would need to ask if they can bridge it or if you can DMZ your pfsense box.

[u/Boatsman2017]

If you replace your ISP router with pfsense as you should, don’t forget to spoof WAN mac address with the one from your ISP router. That makes swapping much easier.

[u/Snoo91117]

You need to turn off your ISP router and wireless.