How to "Reverse NAT"?
-
Version 2.5.2-RELEASE (amd64)
built on Fri Jul 02 15:33:00 EDT 2021
FreeBSD 12.2-STABLEI have an IP camera out in our neighborhood that I want to access remotely.
Many neighbors here contribute to our neighborhood surveillance system.
All camera feeds are hosted by them and use their router to allow the server to access it remotely.There is no firewall in the consumer router that the homeowner has.
SO...I am using NAT to translate it to non-standard ports along with complex passwords and dynamic DNS to contact them.
However, my newest cameras have great features, but using a driver that I cannot edit the ports it uses to connect.
My goal is to return the non-standard ports I'm publishing BACK to the standard ports.
(Reverse the NAT back to standard ports) so that the server will be able to each the camera again.Is there a way to do this natively in PFSense?
[remote IP cam]<->[NAT std 2 odd ports]<->[INET]<->[NAT odd 2 std ports]<->[video server]
-
Any thoughts Anyone?
-
@lburns this seems like a standard port forward just changing the Port you forward too.
internet ---> publicIP:X (pfsense) ---> privateIP:Y
Example I do this for my plex server the public port is 23040 while the plex server is on its standard port this pretty much impossible to change 32400.
While some soho router might not support this - I would assume many do..
Another advantage of pfsense as the router would be you could limit what IP or IPs could even access said port forward. See the source Address using alias pfb_allowedPFb_v4 alias - this contains IPs that can access my port forward.
-
@johnpoz I appreciate the reply however, I know how NAT works but I’m trying to figure out how I can revert the NAT mapping back to standard ports on the other side.
Right now I don’t know how to do anything other than publish nonstandard, translated ports and then tell the remote application about those odd versions of those parts.
My application won’t permit odd port numbers to be used but I must use them to get out of the remote building.
So to be clear, I’m trying to NAT on the outbound side and then NAT BACK on the inbound side to the standard ports.
-
@lburns The homeowners router has to have the ability to port forward and change ports. You cannot do this remotely. If the homeowners camera is on port 8080.. whatever router they are using has to be able to port forward to 8080. If you want to access it using port 8090 then that router has to do port translation "in house"..
Unless I am missing the point of your question..
-
@chpalmer
OK so yes, this is going off the rails.I have access to both sides.
Both routers NAT just fine.
I understand how it works however, I have to reverse the NAT Mapping so that my application server sees standard ports for these cameras.
So if I Nat Port 80 on the customer side to something like 1880 I need to convert 1880 on my end back to port 80 as it comes in.
This way my application servers don’t need to be aware of a crazy port number which they are incapable of doing.
When I speak to the camera from the application I will do it on port 80 but when it hits the firewall on my end it needs to leave our site at 1880.
It’ll arrive on the customer side at 1880
Where it will use NAT back to port 80.
So I need to convert and in-convert on both ends.
This is why I referred to it as a reverse NAT on my firewall.
I made a picture and everything else n the original post, hoping that would be clear.
I hope this clears it up.
-
@lburns said in How to "Reverse NAT"?:
@chpalmer
OK so yes, this is going off the rails.I have access to both sides.
Both routers NAT just fine.
I understand how it works however, I have to reverse the NAT Mapping so that my application server sees standard ports for these cameras.
So if I Nat Port 80 on the customer side to something like 1880 I need to convert 1880 on my end back to port 80 as it comes in.
This way my application servers don’t need to be aware of a crazy port number which they are incapable of doing.
When I speak to the camera from the application I will do it on port 80 but when it hits the firewall on my end it needs to leave our site at 1880.
It’ll arrive on the customer side at 1880
Where it will use NAT back to port 80.
So I need to convert and in-convert on both ends.
This is why I referred to it as a reverse NAT on my firewall.
I made a picture and everything else n the original post, hoping that would be clear.
I hope this clears it up.
Well, if your firewall is also a soho device (not pfSense), I don’t think what you’re asking is possible.
But if your firewall is a pfSense, you should be able to setup at Port NAT that does this translation for you (as long as it is a simple TCP session (fx http).
To create your NAT rule, you could invent a ficticios private IP address and port number for the camera in question. Fx: 192.168.200.10:80.
You then create a NAT rule on the LAN interface (Where your monitor application resides) with source being default any, and destination being 192.168.200.10 port 80.
Then the redirect address should be the public IP of the camera, and the “unusual” portnumber (in your case 1880).
You then create the camera on your application as being 192.168.200.10:80, and your pfSense will NAT it towards the actual public IP and port.In fact, you could do this for all your cameras, and put them in the ficticios 192.168.200.x range. That way you only ever change your firewall NAT rule whenever ever a camera changes IP/Port out in the real world.
-
@lburns Just read the first reply. It explains how to do it.
