I want to route data from one pfSense LAN to another LAN which has a pfSense device. This following image should suffice showing my network. I apologize it's a link and not an embedded image.

Network Layout

I have 2 LANs to manage. Blue lines show connections. The red line shows a new connection I made that I cannot get working.


This LAN is "headed" by a Cisco gateway. I have no access to this device, and I will never have access to this device. It is connected to some stacked Dell switches (not shown in the image), and individual devices connect to that Dell switch stack. One of these devices is a pfSense VM with 1 interface (configured as LAN). This pfSense VM, colloquially known as "Dot 5," serves as the DHCP server and DNS server on the subnet,


I created this LAN using an old Netgate box and a switch having several devices connected to it. This pfSense box had 3 interfaces: WAN, LAN, and a VPN. I just added a 4th, OPT. And this is where the red line comes into the drawing.

My Desired Goal

I have a workstation on LAN 2 that I would like to use to remote desktop into several workstations on LAN 1. I imagined I could use LAN 2's OPT IP address and a unique port as my target, and somewhere I could configure TCP traffic to reroute to the desired/actual IP and port of the target workstation. For example, targetting would go to and would go to This is how I imagine it could work because I can communicate with from LAN 2.

  1. Is this possible given my network layout?
  2. Should I add a new interface on Dot 5 to connect the two LANs?
  3. Should I reach the actual workstation, e.g.,, using another means?

On LAN 2's pfSense box, I've tried adding permissive firewall rules on the LAN and OPT interfaces as well as permissive Floating rules. Nothing for Port Forward. A rule on Outbound NAT that translates everything from to The last thing I did was added a Gateway and Static Route on Dot 5 for, and this didn't seem to change anything. Also, LAN 2's pfSense box is currently configured using a static IP with a gateway of (yes, Dot 5); I don't see any difference if I configure its OPT interface to dynamically fetch an IP address other than the gateway becomes the Cisco box on LAN 1.

Throughout this process I've come to realize that some of my decisions were incorrect, like firewall rules affect inbound traffic to that interface, but at this point I'm grasping at straws.

I hope what I've presented thus far is clear. What other details would you need to know about this network?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.