SOLVED : accessing internal network from wan side

[hchady]

pfsense is acting as a gateway… so it is a NAT setup
i have tried to 1:1 NAT for some IP (i have add also virtual IP), in this way internal ip is seen as a public ip and i can ping from lan to outside. but pings are not possible from a pc on the campus to the pulic ip used for 1:1 NAT

[hoba]

Probably a firewallrule issue- Check your rules and status>systemlogs, firewall tab for blocked traffic.

[hchady]

may be, i cannot also ping the server wan adress from outside

[hoba]

By default the pfSense doesn't answer to anything at WAN. You have to add rules for everything that should be allowed. Not answering to pings is default behaviour.

[hchady]

hi,
i have add a rule on wan interface : any to any but pfsense still not pingeable

[Perry]

My way (default pfSense install ) echo from wan

[hchady]

still not working here

[hoba]

Do you see the blocked traffic at status>systemlogs, firewall? If yes your rules are not correct. If no something in front of you allready is filtering the traffic.

[hchady]

i see a lot of blocked rules /IP

the actual rule i have now on WAN interface is
Intergace : WAN
Source : Any
Destination : LAN subnet

What should i change ?

---

pfsense WAN IP : 134.214.116.244
VIP : 134.214.116.30
NAT 1:1 : 134.214.116.30 to internal IP : 192.168.10.200

[hchady]

now and after a reboot, only the WAN IP adress is pingeable from outside but not Virtual IPs.

system log show that ping requests are blocked at wan side

rules
Interface : WAN
Source : Any
Destination : 134.214.116.30

and

Interface : WAN
Source : Any
Destination : WAN adress

protocol : Any in both cases

[hoba]

What version are you running? Sounds like 1.0 which had a rule apply bug under some circumstances. I recommend upgrading.

[hchady]

I am running the 27-02- Snapshot.
I am sure that it is a firewall problem because I see in syslogs that ping to my VIP are blocked…

[hoba]

Btw, we do not redirect protocol ICMP, so this won't be natted. In case you want to make the VIP pingable you have to use type CARP (currently the only virtual IP that allows for ICMP) and add an firewall rule at WAN for protocol ICMP, source any, destination virtual WAN IP.

[hchady]

that is exactely what i have done but with Proxy ARP.

if i move to crap, I get this error message :
Sorry, we could not locate an interface with a matching subnet for 134.214.116.30/32. Please add an ip in this subnet on a real interface

[hoba]

CARP IPs have to use the real interfaces subnet, not /32.

[hchady]

the same message :
Sorry, we could not locate an interface with a matching subnet for 134.214.116.30/22. Please add an ip in this subnet on a real interface

note that on wan i use 134.214.116.x/22 subnet and on lan side : 192.168.10.x/24

[hoba]

Is your WAN VIP part of the original WAN subnet? If not CARP won't be an option here.

[hchady]

yes
my main internet IP adress is 134.214.116.244 /22 … in the same range

[hchady]

so ? it is a bugg ?

[hoba]

I don't have the possibility to test atm. It used to work.