mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-07-16 10:59:54 +00:00
remove some language
This commit is contained in:
Owen
@@ -17,7 +17,7 @@ Use this guide if clients behind OPNsense are frequently relayed instead of conn
|
||||
- Ability to edit NAT and service settings
|
||||
- A way to verify Pangolin connection mode after changes
|
||||
|
||||
## Option 1: Static outbound UDP mapping
|
||||
## Static outbound UDP mapping
|
||||
|
||||
This approach keeps outbound source ports predictable so UDP hole punching succeeds more often.
|
||||
|
||||
@@ -28,33 +28,6 @@ This approach keeps outbound source ports predictable so UDP hole punching succe
|
||||
5. Enable **Static Port** in the translation section.
|
||||
6. Save and apply changes.
|
||||
|
||||
<Note>
|
||||
Image description from the source references: the Outbound NAT page showing a UDP rule with static-port translation enabled, created in hybrid mode and applied at the top of the outbound rules list.
|
||||
</Note>
|
||||
|
||||
## Option 2: NAT-PMP
|
||||
|
||||
If your environment allows it, NAT-PMP can let clients request temporary UDP mappings dynamically.
|
||||
|
||||
1. Open **Services > Universal Plug and Play**.
|
||||
2. Enable NAT-PMP support.
|
||||
3. Keep the scope as narrow as your policy allows.
|
||||
4. Apply changes.
|
||||
|
||||
<Warning>
|
||||
NAT-PMP can improve connectivity, but may broaden mapping behavior. Use restricted ACLs and network segmentation where possible.
|
||||
</Warning>
|
||||
|
||||
<Note>
|
||||
Image description from the source references: the UPnP/NAT-PMP settings panel with NAT-PMP allowed, indicating dynamic mapping is enabled for LAN clients.
|
||||
</Note>
|
||||
|
||||
## Optional: Running Tailscale plugin on OPNsense
|
||||
|
||||
Source material notes that recent OPNsense releases include an `os-tailscale` community plugin. That workflow is specific to Tailscale installations on the firewall itself and is separate from Pangolin client/site tuning.
|
||||
|
||||
For Pangolin, prioritize the NAT behavior changes above.
|
||||
|
||||
## Validate the result
|
||||
|
||||
1. Reconnect a Pangolin client.
|
||||
|
||||
@@ -23,12 +23,7 @@ Direct paths usually mean:
|
||||
- Better throughput
|
||||
- Less relay traffic on your Pangolin infrastructure
|
||||
|
||||
## Security and performance trade-off
|
||||
|
||||
Some changes that improve direct connectivity can also widen inbound mapping behavior. Review each setting with your security team before enabling it globally.
|
||||
|
||||
- NAT-PMP or UPnP can increase exposure if left broad
|
||||
- Static or persistent port translation can improve predictability, but should be scoped to known traffic when possible
|
||||
Learn more about how [Pangolin NAT hole punching works](https://pangolin.net/news/nat-holepunching).
|
||||
|
||||
## Connection behavior quick guide
|
||||
|
||||
@@ -42,16 +37,4 @@ Some changes that improve direct connectivity can also widen inbound mapping beh
|
||||
|
||||
- [OPNsense guide](/manage/clients/firewalls/opnsense)
|
||||
- [pfSense guide](/manage/clients/firewalls/pfsense)
|
||||
- [Palo Alto Networks guide](/manage/clients/firewalls/palo-alto)
|
||||
|
||||
## Verifying impact
|
||||
|
||||
After applying changes:
|
||||
|
||||
1. Reconnect the client and site.
|
||||
2. Check connection status in the Pangolin client JSON view or `pangolin status`.
|
||||
3. Confirm more sessions are direct and fewer are relayed.
|
||||
|
||||
<Note>
|
||||
Image description from the source references: a summary banner showing that direct peer-to-peer is preferred, with relay as fallback when NAT policies prevent direct UDP paths.
|
||||
</Note>
|
||||
- [Palo Alto Networks guide](/manage/clients/firewalls/palo-alto)
|
||||
@@ -28,10 +28,6 @@ Prefer **Persistent Dynamic IP and Port** for NAT policies handling Pangolin tra
|
||||
|
||||
This keeps NAT behavior more consistent per client flow and improves direct-connect success.
|
||||
|
||||
<Note>
|
||||
Image description from the source references: NAT Policy Rule editor on the Translated Packet tab, with Translation Type set to Persistent Dynamic IP and Port.
|
||||
</Note>
|
||||
|
||||
## Selective policy approach
|
||||
|
||||
If you cannot apply persistent translation globally, scope it to Pangolin UDP traffic only.
|
||||
@@ -41,10 +37,6 @@ If you cannot apply persistent translation globally, scope it to Pangolin UDP tr
|
||||
3. Apply persistent translation only for matching traffic.
|
||||
4. Commit and test.
|
||||
|
||||
<Note>
|
||||
Image description from the source references: one screen shows a custom UDP service definition with timeout tuning; another shows that service selected in NAT policy match criteria.
|
||||
</Note>
|
||||
|
||||
## Earlier PAN-OS releases
|
||||
|
||||
If your version does not support persistent dynamic translation, a **Static IP** NAT policy can improve direct connectivity for selected high-value nodes (for example, a frequently used subnet or gateway host).
|
||||
@@ -53,12 +45,9 @@ If your version does not support persistent dynamic translation, a **Static IP**
|
||||
- Set Translation Type to Static IP
|
||||
- Scope rules tightly and test
|
||||
|
||||
<Note>
|
||||
Image description from the source references: older NAT policy editor where Translation Type is set to Static IP instead of Dynamic IP and Port.
|
||||
</Note>
|
||||
|
||||
## Validate the result
|
||||
|
||||
1. Reconnect Pangolin clients and sites.
|
||||
2. Check whether previously relayed sessions now establish direct paths.
|
||||
3. Keep monitoring for policy side effects or unintended exposure.
|
||||
1. Reconnect a Pangolin client.
|
||||
2. Check the site entry in client status (`isRelay` in JSON view or `RELAY` column in CLI).
|
||||
3. Compare before/after to confirm improved direct connectivity.
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ Use this guide if clients behind pfSense regularly fall back to relay.
|
||||
- Permission to change outbound NAT and service settings
|
||||
- A test client/site pair to validate results
|
||||
|
||||
## Option 1: Static outbound UDP mapping
|
||||
## Static outbound UDP mapping
|
||||
|
||||
Static outbound mapping improves source-port consistency, which helps UDP hole punching.
|
||||
|
||||
@@ -28,33 +28,9 @@ Static outbound mapping improves source-port consistency, which helps UDP hole p
|
||||
5. Enable **Static Port** translation.
|
||||
6. Save and apply.
|
||||
|
||||
<Note>
|
||||
Image description from the source references: pfSense outbound NAT screen with a UDP rule in hybrid mode and static-port translation enabled.
|
||||
</Note>
|
||||
|
||||
## Option 2: NAT-PMP
|
||||
|
||||
For compatible environments, NAT-PMP can allow temporary port mappings for clients.
|
||||
|
||||
1. Open **Services > UPnP & NAT-PMP**.
|
||||
2. Enable NAT-PMP mapping.
|
||||
3. Limit allowed interfaces and clients where possible.
|
||||
4. Save and apply changes.
|
||||
|
||||
<Warning>
|
||||
NAT-PMP and UPnP can reduce relay usage but should be scoped carefully to avoid opening unnecessary mapping paths.
|
||||
</Warning>
|
||||
|
||||
<Note>
|
||||
Image description from the source references: the pfSense UPnP & NAT-PMP settings page with NAT-PMP enabled.
|
||||
</Note>
|
||||
|
||||
## Newer pfSense behavior
|
||||
|
||||
The source references newer pfSense builds adding endpoint-independent style outbound NAT options. If available in your version, test these features in a controlled environment before broad rollout.
|
||||
|
||||
## Validate the result
|
||||
|
||||
1. Reconnect Pangolin clients.
|
||||
2. Inspect connection mode in client status.
|
||||
3. Confirm direct sessions increase and relay sessions decrease.
|
||||
1. Reconnect a Pangolin client.
|
||||
2. Check the site entry in client status (`isRelay` in JSON view or `RELAY` column in CLI).
|
||||
3. Compare before/after to confirm improved direct connectivity.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user