I had a chance to play with this some more over the weekend, which
proved enlightening. So yes cmb, I suspect Packet Capture does see
all frames, but I unfortuantely was only looking at ones (filtered) by
specific IP addresses… otherwise there are just so many... :-)
Silly me for thinking that if I do not define any NAT options or parameters
that NAT would not be active and that all the addresses in my public (LAN)
network would appear as public addresses on the WAN with access limited
(filtered) by the firewall rules. Apparently not so.
I discovered that many outgoing connections appear on the WAN as coming
from the WAN interface address. I was seeing ftp packets going out from the
public IP address from my LAN but not seeing anything coming back from the
FTP server on the WAN because, I guess, it was coming back to the WAN
interface address. At least that's what I think was happening.
A similar thing may have been happening with HTTP as the web servers were
being told the client was at the WAN interface address. But HTTP being the
way it is, all the magic port assignments seemed to allow communications.
Except for the (secured) web server that wouldn't let me talk to it because
it did not recognise the request as coming from my proper public IP address.
I wonder if any other similar failures have gone unnoticed... Oddly, as best
I can tell without looking too deeply, not all protocols or ports are afflicted
with NAT translations (eg. DNS, NTP). Or so it seems.
Anyways, that is what I think was happening, so locating the solution became
less difficult. The first was to force NAT into a full 1:1 for all addresses of the
public LAN network. And suddenly everything behaved as expected. I also
found I could configure NAT Outbound for "Advanced Outbound NAT (AON)",
and once I removed the automatically generated mapping (which essentially
turned NAT back on for the LAN network) my "firewall" now seems to behave
like a simple router with access controlled by the firewall rules. Which is all I
wanted in the first place ;-)
Thankfully, with active mode FTP now working I can close up all those high
ports needed for passive mode... I was astonished at how quickly and how
often they were probed. And now sites expecting to "see" my public IP
addresses are happy.
All in all, I'm very pleased with pfSense. My praises to all involved in making it
such a useful, flexible, and effective product!
