NAT Source Allow Rule not working

[tompark]

Hi Guys and Gals',

I have a strange issue with a NAT Rule.

I have configured an Alias that contains some "safe" IP's being our office IP's. These are then used as a source for one of our NAT Rules to a server.

What is strange is the rule is working for all IP's expect one. When I check the firewall logs I can see the following

Nov 16 13:33:17	WAN	Default deny rule IPv4 (1000000103)	  81.*.*.*:10416	  51.*.*.*:8081	TCP:S

I can't locate the rule that is blocking the connection, has anyone ever had this issue beofre or know how we can get around this?

I have also tried a direct NAT using the Source IP on its own (not part of the Alias but it has the same result.

Regards,

[viragomann]

@tompark
The default deny rule is a hidden rule on each interface. It is applied to a traffic if not any of the other rules of your rule set matches it.

I assume your NAT rule has the pass option set or an associated filter rule.
So that the traffic is blocked though means that the NAT rule doesn't match to that access.
The properties which must match are:
interface, address family, protocol, source IP and port, destination IP and port
Presumably at least one of them doesn't match.
But without knowing details of your NAT rule I cannot verify.

[johnpoz]

Could/Would be very helpful if could get a screen shot of your nat setup, the rules on wan and if any floating rules those as well.

But as mention by @viragomann if no rules match to allow, then yes traffic would be block by the default deny (not actually shown in the gui) But is default for all interfaces.

Traffic that is out of state would also be blocked by the default deny. So if pfsense does not know about the traffic (never saw a syn to open the state) then it would be denied.

What you show there is S (syn) block - so for some reason that traffic did not match your allow rules.

[tompark]

Hi both,

Thank you for your input, this made me re-think what might be happening here.

What I managed to figure out is that one of our ISP's presents the connection from a host name instead of giving the IP. I have now modified the Alias to include the Public Host (reverse dns of my IP) into the Alias and it now working as expected.

For future is there anywhere in the logs where PFSense shows the hostnames of remote machines?

If not that is fine its just a check that I need to keep in mind when diagnosing these types of issue moving forward.

[johnpoz]

@tompark said in NAT Source Allow Rule not working:

where PFSense shows the hostnames of remote machines?

The only way pfsense can do that is if it can resolve the PTR of the ip..

example - click the little "i"

[SteveITS]

@tompark said in NAT Source Allow Rule not working:

anywhere in the logs where PFSense shows the hostnames of remote machines

In the firewall log click the "i" icon next to an IP to try to resolve an IP to a hostname.

[johnpoz]

@steveits oh man you beat me to it - but I got in a picture ;) hehehe

edit: Oh wait I beat you, heheheh