pfSense NAT to server in a second LAN subnet behind an internal second router (not working)

tr flag

I have a pfSense firewall/router that is exposing some services to my public ip.

This is working fine, as long as the service is on the primary LAN subnet (, let's call it LAN-A.

E.g. this works:

public_ip:443 -> pfSense (NAT) -> (reverse proxy)

I additionally have a second LAN, let's call it LAN-B, that is behind a Mikrotik router on In pfSense I have a static route for the network specifying as the gateway for it.

From LAN-A I can now connect to hosts in LAN-B, e.g., transparently, the same as to hosts in LAN-A (apart from a strange issue with ssh mentioned here, still unsolved). (Hosts on LAN-B can also connect to the internet normally, because the Mikrotik router specifies the pfSense box on as gateway to its clients).

So far so good. But now I want to expose a service on LAN-B, say via NAT on my external IP. So I do the same as normally:

public_ip:10000 -> pfSense (NAT+Rule) ->

This, however, doesn't work (and nmap from outside shows the port as filtered, where within the LAN it is open). So it seems that the NAT logic doesn't know about my static route?

It seems somehow logical, because the static route "lives" in the scope of my local interface (LANBRIDGE) of pfSense, and the firewall (NAT) between WAN and LANBRIDGE, so it probably doesn't know the connection to goes through But how to make this work?

tr flag

Found the issue (for later reference and possibly helps others):

The described setup (OP) is ok on the pfSense side.

The problem was that the Mikrotik router should forward (forward chain) for the actual source addresses (i.e. the ones connecting to the external IP), which would be and not only addresses For security reasons the forward rule can be limited to certain ports if needed.


Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.