Allow access without NAT IP?
-
I can't seem to find the right terminology to dig further into this requirement.
I have someone that needs access to the LAN but his IP keeps changing and he's at three different places regularly.He needs access to a handful of machines, not the entire LAN.
I would prefer not getting into anything VPN which I believe is one way but is there another way to allow this person into the LAN without having to constantly change NAT rules?
-
@lewis When you say nat rules, I take it you are locking down the port forward to his source IP.
Well just have him setup a dynamic dns for his connection.. Lots of free services, so his machine will update this fqdn with his current IP.. Now you setup your port forward rules on pfsense to only allow this fqdn as the source.
-
Yup, dyndns would work great there. If it's only 3 IPs you could just use an alias as source with those in. But, as you said, you should be using a VPN here if what they are accessing is in any way valuable.
Steve
-
We use Outagesio.com to monitor his internet connections and providers and that does have a free ddns option. I'll take a look at that.
The problem is that he isn't always at the same location.
He needs access to around 4 or 5 servers but is restricted to those.I know iptables doesn't allow using FQDN but you're saying that pfsense does? I never knew this. That's powerful and if I understand it, will work.
Thanks everyone. Let me give this a try and report back.
-
@lewis just create an alias and put in the fqdn.. Then use that alias as your source.
-
@johnpoz said in Allow access without NAT IP?:
@lewis just create an alias and put in the fqdn.. Then use that alias as your source.
I just noticed I do have an FQDN alias, for the voip provider.
That's great, that will work.Thanks so much. I just love pfsense. I recommend it to anyone I come across that talks about needing a firewall. It's amazing.
