Redirecting outcoming traffic
-
Thanks @johnpoz... i already considered a dns view but the dns queries may come from virtually anywhere, so.... :-(
-
I am curious as to why? If your balancing across 3 different machines, they all need to provide the same info... Why would you want/need to direct specific source IPs to a specific destination in your group?
If you proxied or forwarded the connections you could do it.. But if your just routing traffic to some public IP space behind you, sure you could create a firewall rule that blocks specific source from talking to x or y, and only allows to Z. But in a round robin dns, they would fail 2 out of 3 times, etc.
Not port forwards are evaluated before rules.. So it might be possible to create a port forward with source of your 20.20.20.0/24 to the specific machine. But you would need to setup 3 of them for your different destinations.. You might get by with an alias for that destination in your port forward..
Then the firewall is just the thing that allows it, but the port forward has already been done to that specific destination IP you want.
-
thanks @johnpoz.
The purpose is to clasify traffic between importance levels... low importance traffic should go to different servers than important traffic.
-
@johnpoz said in Redirecting outcoming traffic:
But just routed with firewall rules to all.. Then no you couldn't redirect..
I cannot think of any reason, why it should not be possible to redirect routed traffic to anything else.
If the traffic is routed to an interface of pfSense, you can. And I even do this, not on WAN indeed, but on other interfaces.However, both directions, inbound and outbound, have to be routed through your firewall.
-
@viragomann please, how do you do that? it may help me...
-
@pedreter Just create a port forward on your wan...
That sends traffic to whatever IP you want when the source is 20.20.20.0/24
The port forward would be used before the firewall that just allows traffic through.
-
@pedreter
It's just a simple port forwarding.
But your set up is still not clear to me. We were talking about routed traffic. So I assume, it is routed to your WAN IP and your pfSense routes it to a public subnet behind. If so, port forwarding should be possible.However, if the public network is bridged to the WAN it would not work. In this case the WAN address is part of the subnet and pfSense cannot route then.
-
@viragomann said in Redirecting outcoming traffic:
I cannot think of any reason, why it should not be possibl
It should be - but if your just routing there are no port forwards in the first place to manipulate.. He will have to just create port forwards even though not needed.
Still no idea why anyone would want/need to do such a thing in the first place.
-
@johnpoz said in Redirecting outcoming traffic:
He will have to just create port forwards even though not needed.
As I said, it's still not clear to me, what he has exactly.
-
@viragomann in my example he said he has what I described, minus the port forwards.. Just firewall rules to allow the traffic.
But why would people from specific source IPs need to go to a specific server that clearly all do the same thing if you have a round robin dns setup..
If you want user X to only go to IP X, then create a new dns record x.domain.tld and tell them to use that.. Controlling it via source IP makes no sense..
-
@johnpoz said in Redirecting outcoming traffic:
Just firewall rules to allow the traffic.
The only configuration I can think of, that would work with just firewall rules for public addresses is a bridge across pfSense. But in this case he cannot route and also not nat.
-
@viragomann no if 1.2.3.0/24 is routed to your wan IP, then all you need to allow something to 1.2.3.x is a firewall rule.
https://docs.netgate.com/pfsense/en/latest/recipes/route-public-ip-addresses.html
-
@johnpoz
Yes. but in a bridged set up, the packets are not routed to the WAN, but directly to the destination IP behind pfSense. So you would be able to control the traffic with filter rules, but nothing else. -
@viragomann true if he is bridging then no port forward wouldn't work..
Still really don't understand why would want/need to do such a thing..
If I have a group of servers that are load balancing some service no matter if through a load balancer or via dns round robin. All of those servers would need to provide the same thing.. If not what if client goes to X vs Y and can't do what they are looking to do.
So why would you want any specific client to go to a specific one? If you did, then just point them there directly via specific fqdn that points to specific IP vs using the round robin fqdn..
-
@johnpoz... i need this because not all traffic has the same importance, so low importance should go to same server, where slow answer do not matter...
-
@pedreter and this low importance always comes from 20.20.20.0/24 ? That doesn't make any sense..
-
@johnpoz let me simply the question, because maybe i am not being clear enough... sorry...
Is it possible with pfsense to change the destination address and redirect all incoming traffic to public IP 'A' to public IP 'B' ??
-
@pedreter Yes.. You need to do a port forward.. But the traffic needs to hit your wan IP.. If your doing a bridge like @viragomann mentions you wouldn't be able to do that..
Lets say I have network 5.6.7.0/24 routed to me through my wan IP of 1.2.3.4
And while I might have a wan rule that allows traffic to 5.6.7.x, if I want to change that to go to 5.6.7.y instead I would setup a port forward..
What are you current wan rules?? For pfsense to redirect traffic - the traffic has to hit pfsense.. for it to be redirected.. It should be possible to setup something like this..
But I am not 100% it would work.. But it should..
-
Million thanks for you time and help @johnpoz
That is the problem... the IP belongs to an internal server, not to the PF Wan interface...
-
@pedreter it is routed through pfsense is it not?
If I look up in the internet routing.. for the IP on this server it ends up on the pfsense wan IP does it not? If the network is routed at the isp and you bridge this network to the servers.. I do not think the redirection via a port forward would work..
