No-IP Updating DDNS Address from VPN
-
@deathgrin Maybe show all rules on Floating and all NAT Outbound rules.
Maybe you have another DDNS Client you forgot about on one of your hosts?
-
@bob-dig I am 99% positive I don't have anything else updating Dynamic DNS besides my pfsense box. Here are snippets of the rules you asked for. I also have manual rules in outbound NAT where I was trying to force all traffic destined for anything NOIP for DDNS updates out my main WAN and not vpn.
-
@deathgrin I don't think you need any of the manual outbound rules (other then xbox) but I am no expert.
But the rules seem to be ok. -
@deathgrin Default Gateway (SystemRoutingGateways) should be WAN, if you haven't checked that.
-
@bob-dig yeah I have my default WAN manually set to the specific ISP Interface and not set to Automatic.
-
@deathgrin Maybe it is a hiding ddclient on some linux server or in your Access-point or something, I don't think it is pfSense.
-
Technically we haven't seen the port forwards and 1:1 NAT yet, maybe there...
-
It sure behaves exactly like something updating it from the LAN.
The policy based routing rules on the LAN interfaces are never hit by traffic generated on the firewall itself. Even if it's sourced from the LAN interface address. So if changing them affects the ddns client it's almost impossible for it to be the firewall.
Yes, those outbound NAT rules are not required except the static ports rule for Xbox.
The one with source 'any' will be NATing traffic soured from it's own WAN IP back to it own IP which can break things. It should definitely be removed. Using source 'any' in an OBN rule is almost always a mistake.
Steve
-
@Bob-Dig I don't have any 1:1 rules setup but here are my port forward rules. @stephenw10 I have deleted all of my NAT rules besides for Xbox. I have started a tcpdump to monitor for any traffic going to noip update address for my LAN, so we shall see if anything reaches out.
-
You could also re-enable the ddns rule on LAN and enable logging on it.
-
Or maybe change the credentials for No-IP and only update the pfSense DDNS Client with that, if they use those.
-
@bob-dig @stephenw10 You guys were 100% right... lol. I ended up having it configured through my wireless router (which I had setup as ap mode only). In AP only mode, it hides the ddns configuration... (smh). So when I checked it as a possibility it didn't show up. But after monitoring tcpdump I saw it reach out and try to update, so changed it back to router mode and was able to disable it. Thank you all for your help!
