> For the complete documentation index, see [llms.txt](https://docs.acecloud.ai/knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acecloud.ai/knowledge-base/tutorials/how-to-attach-a-floating-ip-via-pfsense.md).

# How to Attach a Floating IP via pfSense?

This SOP provides step-by-step instructions to configure **pfSense firewall**, including attaching and using a **Floating IP** via a dedicated network interface. This allows the internal VM to be reachable via public IP using 1:1 NAT.

## **Pre-requisites:**

* pfSense VM deployed and accessible
* Floating IP is available in the public pool
* VM created and reachable from pfSense LAN

## **STEPS TO FOLLOW:**

### **Step 1: Assign the New Public Interface to pfSense**

1. Attach a floating IP or public interface to the pfsense VM.
2. Access pfSense Web GUI:

Use a VM (e.g., a Windows or Linux VM) that is created from the same internal VPC/subnet as pfSense's LAN interface

* Open a browser on that VM via console
* Go to: https\://\<pfSense-LAN-IP>

Example: <https://192.168.7.1>

**Accessing pfSense GUI in Browser**

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/ll41dKgfmATOrwk8agwm/Unknown%20image)

1. Log in to the **pfSense Web UI**.
2. Go to: **Interfaces > Assignments**

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/RENG6IdLP7femZcITWH0/Unknown%20image)

3. Under **Available Network Ports**, click **Add** next to the newly attached public (Floating IP) network interface.

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/7XxHpe3wAK2EvjMkU8SG/Unknown%20image)

### **Step 2: Configure the New Interface (e.g., OPT1)**

1. Navigate to: **Interfaces > OPT1** (or whatever the new interface is named)

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/UqoPzEHKcCVVtjXnXERD/Unknown%20image)

2. Check **Enable Interface**.

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/OCKWO8RChasFxuGF0B0a/Unknown%20image)

3. Change the description to a client-specific name, such as **Client1\_FloatingIP\_Interface.** (Optional)
4. Set:

**a. IPv4 Configuration Type**: DHCP

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/CzppjDoMeliE6Nq2unet/Unknown%20image)

5. Scroll down, click **Save**, then **Apply Changes.**

### **Step 3: Create Firewall Rule to Allow Traffic on New Interface**

1. Go to: **Firewall > Rules**

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/DRinffQhnV1nyIf5wmna/Unknown%20image)

2. Select the tab for the **new interface** (e.g., OPT1) and click **+ Add** rule.

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/Kuf4hkQEw99rNFecFnSi/Unknown%20image)

**a. Action**: Pass

**b. Interface**: OPT1

**c. Source**: Any

**d. Destination**: Any

e. Add Description: Allow Public Access for Client. (Optional)&#x20;

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/vDd2F9syQBd7wsvd7iFj/Unknown%20image)

4. Click **Save**, then **Apply Changes**

This allows incoming traffic to the Floating IP for the client VM. You can restrict it to specific IPs later.

### **Step 4: Configure 1:1 NAT to Internal VM**

1. Navigate to: **Firewall > NAT > 1:1**

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/WtzngGjvIckOFBu4ApVk/Unknown%20image)

2. Click **+ Add**

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/tpUb6T2bLAp4pwSYMzDL/Unknown%20image)

3. Fill in:

* **Interface**: OPT1(Newly added—eg windowsvm1)
* **External Subnet IP**: The Floating IP assigned via DHCP
* **Internal IP**: Private IP of the internal VM (e.g., 192.168.7.10)
* **Description**: e.g., Client1\_Floating\_NAT

![](https://content.gitbook.com/content/VBa3yjTJ7LPbjby0TKRi/blobs/YP2vtG7QSFF4xIH9e9cd/Unknown%20image)

4. Click **Save**, then **Apply Changes**

This sets up a 1:1 mapping between the public IP and the internal VM.

### **Step 5: Validate Connectivity**

1. Ping or browse to the **Floating IP**
2. Ensure it forwards correctly to the internal VM (e.g., RDP, HTTP, SSH)

## **Additional Notes**

* You can configure **multiple NAT rules** if the client has more internal VMs and Floating IPs.
* pfSense's **firewall rules work similarly to Security Groups** — restrict access as needed by source IP, port, or protocol.
* Ensure that the internal VM has **pfSense's LAN IP as the gateway**.