Redirecting outcoming traffic
-
@pedreter said in Redirecting outcoming traffic:
I have a group of servers inside my LAN with balacing via DNS. When an external client wants to connect, via DNS the client gets a destination IP among those servers.
So create a hosts alias and add all these IPs to it.
In a pseudo language it would be something like: all internet incoming traffic from IP net 20.20.20.0/24 going to any LAN address ---> change destination IP to 192.168.2.20
Again, from outside no one can use the any of your LAN IPs as destination. You may probably have multiple WAN addresses and forward these to some LAN IPs. So the outside client sends the request to one of the WAN IPs.
So then add a NAT port forwarding rule, set 20.20.20.0/24 as source and the server IPs alias as destination, state the destination port and enter 192.168.2.20 at redirect target and also the port.
Move this rule up above of the other port forwarding rule. -
@pedreter said in Redirecting outcoming traffic:
via DNS the client gets a destination IP among those servers
Ok let me make sure understand what you want and what is going on..
So you have some dns say www.domain.tld that via round robin dns points to 3 different public IPs you have lets call them.
1.2.3.100
1.2.3.101
1.2.3.102Now if they hit your pfsense via the .100 address they get sent to say 192.168.2.100, if they hit 1.2.3.101 they go to 192.168.2.101, etc.
So now what you want is no matter what public IP they hit 1.2.3.100,101 or 102 you want them to go to only 192.168.2.100 if they come from public IP range 20.20.20.0/24
Is this what your after and how your setup?
-
Exactly @johnpoz
just antoher my mistake... internally IP is no 192.168.2.20 but 1.2.3.103 so ALL of them are valid public IPs... (192.168 again my typo, sorry)....
But yes, Johnpoz... this is EXATCLY what i need...
Thanks,
Pete.
-
@pedreter if the internal IPs are public, your not port forwarding.. So not sure how you would do it.. If you were port forwarding then you could do it.. But just routed with firewall rules to all.. Then no you couldn't redirect.. That would have to be done via say a view on your dns - which can be done pretty easy, depending on what dns your using?
-
Thanks @johnpoz... i already considered a dns view but the dns queries may come from virtually anywhere, so.... :-(
-
I am curious as to why? If your balancing across 3 different machines, they all need to provide the same info... Why would you want/need to direct specific source IPs to a specific destination in your group?
If you proxied or forwarded the connections you could do it.. But if your just routing traffic to some public IP space behind you, sure you could create a firewall rule that blocks specific source from talking to x or y, and only allows to Z. But in a round robin dns, they would fail 2 out of 3 times, etc.
Not port forwards are evaluated before rules.. So it might be possible to create a port forward with source of your 20.20.20.0/24 to the specific machine. But you would need to setup 3 of them for your different destinations.. You might get by with an alias for that destination in your port forward..
Then the firewall is just the thing that allows it, but the port forward has already been done to that specific destination IP you want.
-
thanks @johnpoz.
The purpose is to clasify traffic between importance levels... low importance traffic should go to different servers than important traffic.
-
@johnpoz said in Redirecting outcoming traffic:
But just routed with firewall rules to all.. Then no you couldn't redirect..
I cannot think of any reason, why it should not be possible to redirect routed traffic to anything else.
If the traffic is routed to an interface of pfSense, you can. And I even do this, not on WAN indeed, but on other interfaces.However, both directions, inbound and outbound, have to be routed through your firewall.
-
@viragomann please, how do you do that? it may help me...
-
@pedreter Just create a port forward on your wan...
That sends traffic to whatever IP you want when the source is 20.20.20.0/24
The port forward would be used before the firewall that just allows traffic through.
-
@pedreter
It's just a simple port forwarding.
But your set up is still not clear to me. We were talking about routed traffic. So I assume, it is routed to your WAN IP and your pfSense routes it to a public subnet behind. If so, port forwarding should be possible.However, if the public network is bridged to the WAN it would not work. In this case the WAN address is part of the subnet and pfSense cannot route then.
-
@viragomann said in Redirecting outcoming traffic:
I cannot think of any reason, why it should not be possibl
It should be - but if your just routing there are no port forwards in the first place to manipulate.. He will have to just create port forwards even though not needed.
Still no idea why anyone would want/need to do such a thing in the first place.
-
@johnpoz said in Redirecting outcoming traffic:
He will have to just create port forwards even though not needed.
As I said, it's still not clear to me, what he has exactly.
-
@viragomann in my example he said he has what I described, minus the port forwards.. Just firewall rules to allow the traffic.
But why would people from specific source IPs need to go to a specific server that clearly all do the same thing if you have a round robin dns setup..
If you want user X to only go to IP X, then create a new dns record x.domain.tld and tell them to use that.. Controlling it via source IP makes no sense..
-
@johnpoz said in Redirecting outcoming traffic:
Just firewall rules to allow the traffic.
The only configuration I can think of, that would work with just firewall rules for public addresses is a bridge across pfSense. But in this case he cannot route and also not nat.
-
@viragomann no if 1.2.3.0/24 is routed to your wan IP, then all you need to allow something to 1.2.3.x is a firewall rule.
https://docs.netgate.com/pfsense/en/latest/recipes/route-public-ip-addresses.html
-
@johnpoz
Yes. but in a bridged set up, the packets are not routed to the WAN, but directly to the destination IP behind pfSense. So you would be able to control the traffic with filter rules, but nothing else. -
@viragomann true if he is bridging then no port forward wouldn't work..
Still really don't understand why would want/need to do such a thing..
If I have a group of servers that are load balancing some service no matter if through a load balancer or via dns round robin. All of those servers would need to provide the same thing.. If not what if client goes to X vs Y and can't do what they are looking to do.
So why would you want any specific client to go to a specific one? If you did, then just point them there directly via specific fqdn that points to specific IP vs using the round robin fqdn..
-
@johnpoz... i need this because not all traffic has the same importance, so low importance should go to same server, where slow answer do not matter...
-
@pedreter and this low importance always comes from 20.20.20.0/24 ? That doesn't make any sense..
