Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFSense rewriting all traffic?

    Scheduled Pinned Locked Moved General pfSense Questions
    32 Posts 3 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dgarner @johnpoz
      last edited by

      @johnpoz Sounds perfect, sir.

      cbd30671-e1f2-4b93-8152-380bbc8cd3ef-image.png

      This is an example, as there are roughly 60 ports open at the moment.

      f8fe55eb-794b-4023-8fc8-af0ad7e096f3-image.png

      Rules
      920137e7-16d9-4229-80c4-8a351d400c4b-image.png

      And here is one thing in particular I am attempting to work out ...

      DHCP
      1c32fefc-885b-4842-84a6-cb68e349a85f-image.png

      e8c24ee8-afa6-4d7e-8f5d-5af8f104876d-image.png

      4bf4aa94-fcbd-4631-9524-6b3e189a95d7-image.png

      I think this is perhaps a good beginning?

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @dgarner
        last edited by johnpoz

        @dgarner what are you wanting to do here

        what.jpg

        That makes no sense to me..

        edit: these make no sense either

        either.jpg

        Why would you forward something that is hitting your pfsense wan address to pfsense lan address? Are you trying to get haproxy to reverse proxy something to inside your network?

        if your running nginx as reverse proxy somewhere behind pfsense, the forward would go to that specific IP..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        D 1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          @dgarner said in PFSense rewriting all traffic?:

          Redirect target IP: LAN Address

          Yup that's almost certainly incorrect.

          1 Reply Last reply Reply Quote 0
          • D
            dgarner @johnpoz
            last edited by

            @johnpoz The whitelisting IP was an attempt to get connectivity to my phone to the network in a rush before I had time to properly install Twingate or a VPN.
            This will be deleted now.
            Thank you for making me notice this again. :D

            Yes, as I believe I said above, that's exactly the objective.
            I am using Nginx by F5 (Not NPM or whatever with the red gem logo) along with Apache as a reverse proxy and am attempting to allow clients to connect on the outside via "web ports."

            80 = duh
            443 = duh
            8080 = Ports on which Apache AND Nginx are running same server, Nginx (80) and Apache (8080) should be serving web content to clients, which almost all of my servers have some sort of web content, even if it's something such as an administrative "CPanel" type web interface.

            I know I have attempted to not use LAN Address before, but I will change back to specific host and see if that resolves it now that things are more configure that previously.

            Thank you for the for confirmation @stephenw10 -- it genuinely means a lot from both of you guys, thank you. :D

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @dgarner
              last edited by johnpoz

              @dgarner what do you think these do exactly?

              wrong.jpg

              Those are not doing anything..

              How many more like that do you have? You mention something about 60 ports?

              Not sure why your running a reverse proxy inside your network, why would you not just run haproxy right on pfsense? Much cleaner way to do it imho.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              D 2 Replies Last reply Reply Quote 0
              • D
                dgarner @johnpoz
                last edited by

                @johnpoz said in PFSense rewriting all traffic?:

                @dgarner what do you think these do exactly?

                wrong.jpg

                Those are not doing anything..

                How many more like that do you have? You mention something about 60 ports?

                Not sure why your running a reverse proxy inside your network, why would you not just run haproxy right on pfsense? Much cleaner way to do it imho.

                Because I have been running a reverse proxy much longer than I have been using PFSense.
                I will look into HA but as NGinx is already set up, it's at least preferable to have it working momentarily until I can make time to switch to HA.

                Those ports were not originally "LAN/LAN" and "WAN/WAN" --those were spaghetti against the wall trying to make this work. Haha.

                1 Reply Last reply Reply Quote 0
                • D
                  dgarner @johnpoz
                  last edited by

                  @johnpoz As an example, most of my Port Fowarding/Rules look like this,
                  668269f2-5636-4697-b1be-09c4da62a6ce-image.png

                  11343e3e-de3d-491d-b9af-1074063d0083-image.png

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @dgarner
                    last edited by johnpoz

                    @dgarner those look normal - not sure why any reason to hide rfc1918 space? Are those public IPs you obfuscated? Are you routing public IP space to behind pfsense? If so there would be no need for any port forwards.

                    If they are rfc1918, as long as that .10 address isn't pfsense address, then those should work unless you had blocking in floating, or in wan that blocked?

                    When troubleshooting port forwards.. Normally couple of minutes running through the troubleshooting guide will find the source of the problem right away.

                    https://docs.netgate.com/pfsense/en/latest/troubleshooting/nat-port-forwards.html

                    spaghetti against the wall trying to make this work. Haha.

                    Never a good idea ;) just makes a mess.. I taste my spaghetti to know if its the proper al dente hahah

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      dgarner @johnpoz
                      last edited by

                      @johnpoz No, I'm just hyper paranoid. :)

                      So, in recap, I have shifted NAT IP from LAN Address to Individual host with port and rules in place to support it, NAT reflection is on Pure NAT and DNS Split is enabled and set up along with DHCP entries to match -- and all machines use PFSense as primary DNS nameserver, including the machine in question.

                      Woohoo -- sorta. All of these have led to finally resolving on LAN side -- ... still not WAN from my phone, though? Hmm.

                      At least we're getting closer.

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @dgarner
                        last edited by

                        @dgarner said in PFSense rewriting all traffic?:

                        still not WAN from my phone, though? Hmm.

                        First step for me would be to actually validate traffic hits your wan from outside via sniff, can you see me . org is good place to test tcp traffic from outside.

                        Then sniff on the lan side interface while doing the test traffic, does pfsense send it on? That would point to maybe a firewall issue on where your forwarding too? Pure nat would nat the source IP, which wouldn't be a local IP. With split dns the IP would be local so maybe the host your sending too allows its own network, but not remote networks, etc.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • D
                          dgarner
                          last edited by

                          @johnpoz Great point. Thank you for the reminder.

                          Ports still remain closed to the outside world.

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @dgarner
                            last edited by

                            @dgarner I would suggest we look at your forward that is not working, and your wan rules for this port.. If tcp send some traffic via say can you see me.. You should be able to track down the problem in couple of minutes..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            D 1 Reply Last reply Reply Quote 0
                            • D
                              dgarner @johnpoz
                              last edited by

                              @johnpoz So, this may be curious?

                              So, there is definitely something listening on all ports previously mentioned, not sure why it says closed and not filtered so much, but will build to it.

                              96527855-5b5b-4a94-9688-af1c576dac28-image.png

                              I've showed you P/F, but here is rule for 80.

                              f7c50b0b-67bd-4374-9194-d80cc7b399be-image.png

                              Destination is blank and not able to be edited - this is perhaps the main thing I could think of, but why would I not be able to edit it, if that is required to point to a specific host.. I guess another question would be, why it's not done automatically, so much.. but for our purposes ..

                              Is this perhaps why and how do I edit it, if it's locked out?

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @dgarner
                                last edited by johnpoz

                                @dgarner this is wrong that is for sure

                                wrongagain.jpg

                                That sure isn't the IP address of this caesar box is it? Your port forward should be to that IP on your lan, some rfc1918 address... Or you proxy your running, it sure isn't going to be pfsense lan IP.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                D 1 Reply Last reply Reply Quote 0
                                • D
                                  dgarner @johnpoz
                                  last edited by

                                  @johnpoz omg, gahh..
                                  These are auto-generated rule matches for NAT P/F ... Why are they not matching exactly or editable?
                                  I guess the job for tonight is to delete all these rules and add them manually with correct IP ... :$

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @dgarner
                                    last edited by

                                    @dgarner in your port forward set the destination, and then yes the firewall rule would be auto created.. If your port forward is set to lan address, then yeah that is what the the firewall rule would be.. Pfsense tries to keep you from shooting yourself in the foot in a lot of ways.. But in the long run its still just going to do what you tell it to do.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    D 1 Reply Last reply Reply Quote 0
                                    • D
                                      dgarner @johnpoz
                                      last edited by

                                      @johnpoz I mean, this makes sense and I am thankful it attempted to.
                                      Perhaps this was created during the initial rule set up and does not automatically update.

                                      So, if I may ask you one or two more questions I hope.. lol.
                                      If I delete the associated rule and ask it to create a new rule, will that one reflect the IP?

                                      Instead of having to manually create all new rules for everything, perhaps I could delete the rules and have them regenerate.

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @dgarner
                                        last edited by johnpoz

                                        @dgarner if your firewall rule is associated with the port forward, then it would update, or be removed if you deleted the port forward. But if the firewall is not associated then no it wouldn't update nor would it be removed on removal of the port forward.

                                        By default pfsense would auto create an associated rule for you when you create the forward. But when you start throwing spaghetti about - who knows that happened.

                                        edit: here I created a forward to my lan address.. Then I corrected it just in the port forward, as you can see the wan firewall rule was updated all on its own

                                        test.jpg

                                        Then when I delete the forward, the wan firewall rule goes away as well.

                                        This should be default when you create a port forward

                                        default.jpg

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        D 1 Reply Last reply Reply Quote 0
                                        • D
                                          dgarner @johnpoz
                                          last edited by

                                          @johnpoz Strange ... I autogenerated new rules, which fixed that issue.
                                          Still nod dice. Hmm.

                                          a719ed72-e91a-4efd-a2b3-7eb31bd98b08-image.png

                                          24df8861-385d-4fb8-8cfe-965fc4f7dba1-image.png

                                          8465abfc-25a1-44d6-b72d-676a2f3c3a3d-image.png

                                          Port closed, site unreachable.

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @dgarner
                                            last edited by johnpoz

                                            @dgarner that rule to 50000 shows a state.. So pfsense sent on the traffic at least.

                                            Here is what I always tell users having issues with port forwards - sniff!

                                            So you can prove to yourself that pfsense is doing what it is suppose to do.. So you stop looking at pfsense as the problem.. Pfsense has one job here.. To pass on traffic to where your forwarding.. If it does that, its job is done.. And well yes return traffic.. But all of that can be seen with simple sniffing

                                            Go to can you see me.. Send traffic to your port 50000, while you sniff - you see it hit your wan, then sniff on lan side where this 10.0.0.x address is.. Do you see pfsense send it on to that IP.. Does that IP send back an answer to pfsense? Is it a RST? Do you not see an answer?

                                            If you do not see an answer - firewall on the host, or pfsense not the gateway. Or something wrong with proxy on that host.. If you see a RST back - then that host said to go away.. And there is nothing pfsense can do about any of those - other than maybe if you source nat the traffic to circumvent firewall on the host your sending traffic to by making it look like the traffic came from pfsense IP on that network - but that is not a good idea normally.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.