diff --git a/manage/clients/firewalls/opnsense.mdx b/manage/clients/firewalls/opnsense.mdx index 03a4f8e..6aaab24 100644 --- a/manage/clients/firewalls/opnsense.mdx +++ b/manage/clients/firewalls/opnsense.mdx @@ -17,7 +17,7 @@ Use this guide if clients behind OPNsense are frequently relayed instead of conn - Ability to edit NAT and service settings - A way to verify Pangolin connection mode after changes -## Option 1: Static outbound UDP mapping +## Static outbound UDP mapping This approach keeps outbound source ports predictable so UDP hole punching succeeds more often. @@ -28,33 +28,6 @@ This approach keeps outbound source ports predictable so UDP hole punching succe 5. Enable **Static Port** in the translation section. 6. Save and apply changes. - -Image description from the source references: the Outbound NAT page showing a UDP rule with static-port translation enabled, created in hybrid mode and applied at the top of the outbound rules list. - - -## Option 2: NAT-PMP - -If your environment allows it, NAT-PMP can let clients request temporary UDP mappings dynamically. - -1. Open **Services > Universal Plug and Play**. -2. Enable NAT-PMP support. -3. Keep the scope as narrow as your policy allows. -4. Apply changes. - - -NAT-PMP can improve connectivity, but may broaden mapping behavior. Use restricted ACLs and network segmentation where possible. - - - -Image description from the source references: the UPnP/NAT-PMP settings panel with NAT-PMP allowed, indicating dynamic mapping is enabled for LAN clients. - - -## Optional: Running Tailscale plugin on OPNsense - -Source material notes that recent OPNsense releases include an `os-tailscale` community plugin. That workflow is specific to Tailscale installations on the firewall itself and is separate from Pangolin client/site tuning. - -For Pangolin, prioritize the NAT behavior changes above. - ## Validate the result 1. Reconnect a Pangolin client. diff --git a/manage/clients/firewalls/overview.mdx b/manage/clients/firewalls/overview.mdx index c5f3b5f..3f81e06 100644 --- a/manage/clients/firewalls/overview.mdx +++ b/manage/clients/firewalls/overview.mdx @@ -23,12 +23,7 @@ Direct paths usually mean: - Better throughput - Less relay traffic on your Pangolin infrastructure -## Security and performance trade-off - -Some changes that improve direct connectivity can also widen inbound mapping behavior. Review each setting with your security team before enabling it globally. - -- NAT-PMP or UPnP can increase exposure if left broad -- Static or persistent port translation can improve predictability, but should be scoped to known traffic when possible +Learn more about how [Pangolin NAT hole punching works](https://pangolin.net/news/nat-holepunching). ## Connection behavior quick guide @@ -42,16 +37,4 @@ Some changes that improve direct connectivity can also widen inbound mapping beh - [OPNsense guide](/manage/clients/firewalls/opnsense) - [pfSense guide](/manage/clients/firewalls/pfsense) -- [Palo Alto Networks guide](/manage/clients/firewalls/palo-alto) - -## Verifying impact - -After applying changes: - -1. Reconnect the client and site. -2. Check connection status in the Pangolin client JSON view or `pangolin status`. -3. Confirm more sessions are direct and fewer are relayed. - - -Image description from the source references: a summary banner showing that direct peer-to-peer is preferred, with relay as fallback when NAT policies prevent direct UDP paths. - +- [Palo Alto Networks guide](/manage/clients/firewalls/palo-alto) \ No newline at end of file diff --git a/manage/clients/firewalls/palo-alto.mdx b/manage/clients/firewalls/palo-alto.mdx index 4ee3d9d..070ed91 100644 --- a/manage/clients/firewalls/palo-alto.mdx +++ b/manage/clients/firewalls/palo-alto.mdx @@ -28,10 +28,6 @@ Prefer **Persistent Dynamic IP and Port** for NAT policies handling Pangolin tra This keeps NAT behavior more consistent per client flow and improves direct-connect success. - -Image description from the source references: NAT Policy Rule editor on the Translated Packet tab, with Translation Type set to Persistent Dynamic IP and Port. - - ## Selective policy approach If you cannot apply persistent translation globally, scope it to Pangolin UDP traffic only. @@ -41,10 +37,6 @@ If you cannot apply persistent translation globally, scope it to Pangolin UDP tr 3. Apply persistent translation only for matching traffic. 4. Commit and test. - -Image description from the source references: one screen shows a custom UDP service definition with timeout tuning; another shows that service selected in NAT policy match criteria. - - ## Earlier PAN-OS releases If your version does not support persistent dynamic translation, a **Static IP** NAT policy can improve direct connectivity for selected high-value nodes (for example, a frequently used subnet or gateway host). @@ -53,12 +45,9 @@ If your version does not support persistent dynamic translation, a **Static IP** - Set Translation Type to Static IP - Scope rules tightly and test - -Image description from the source references: older NAT policy editor where Translation Type is set to Static IP instead of Dynamic IP and Port. - - ## Validate the result -1. Reconnect Pangolin clients and sites. -2. Check whether previously relayed sessions now establish direct paths. -3. Keep monitoring for policy side effects or unintended exposure. +1. Reconnect a Pangolin client. +2. Check the site entry in client status (`isRelay` in JSON view or `RELAY` column in CLI). +3. Compare before/after to confirm improved direct connectivity. + diff --git a/manage/clients/firewalls/pfsense.mdx b/manage/clients/firewalls/pfsense.mdx index 530c422..0516ef4 100644 --- a/manage/clients/firewalls/pfsense.mdx +++ b/manage/clients/firewalls/pfsense.mdx @@ -17,7 +17,7 @@ Use this guide if clients behind pfSense regularly fall back to relay. - Permission to change outbound NAT and service settings - A test client/site pair to validate results -## Option 1: Static outbound UDP mapping +## Static outbound UDP mapping Static outbound mapping improves source-port consistency, which helps UDP hole punching. @@ -28,33 +28,9 @@ Static outbound mapping improves source-port consistency, which helps UDP hole p 5. Enable **Static Port** translation. 6. Save and apply. - -Image description from the source references: pfSense outbound NAT screen with a UDP rule in hybrid mode and static-port translation enabled. - - -## Option 2: NAT-PMP - -For compatible environments, NAT-PMP can allow temporary port mappings for clients. - -1. Open **Services > UPnP & NAT-PMP**. -2. Enable NAT-PMP mapping. -3. Limit allowed interfaces and clients where possible. -4. Save and apply changes. - - -NAT-PMP and UPnP can reduce relay usage but should be scoped carefully to avoid opening unnecessary mapping paths. - - - -Image description from the source references: the pfSense UPnP & NAT-PMP settings page with NAT-PMP enabled. - - -## Newer pfSense behavior - -The source references newer pfSense builds adding endpoint-independent style outbound NAT options. If available in your version, test these features in a controlled environment before broad rollout. - ## Validate the result -1. Reconnect Pangolin clients. -2. Inspect connection mode in client status. -3. Confirm direct sessions increase and relay sessions decrease. +1. Reconnect a Pangolin client. +2. Check the site entry in client status (`isRelay` in JSON view or `RELAY` column in CLI). +3. Compare before/after to confirm improved direct connectivity. +