Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Nat & ssh problem

    Scheduled Pinned Locked Moved NAT
    40 Posts 5 Posters 20.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      spazio
      last edited by

      First i deleted the nat and rule on port 22 and then created a new nat on port 2500 that created automaticly the rule.

      1 Reply Last reply Reply Quote 0
      • D
        danswartz
        last edited by

        it shouldn't have blocked it then :(

        1 Reply Last reply Reply Quote 0
        • T
          thafener
          last edited by

          Spazio,

          Did you find a solution for this meanwhile as I have the same problem with NAT over here.
          I have solved it once in a absolutely strange way. I have delted all FW and NAT rules, made
          a backup of the box and made a fresh install. Then I have created the rules manually again.
          Then I have made the rules created by NAT the first ones and it worked for some 10 days
          but it has stopped working again. :-[

          cheers thafener

          1 Reply Last reply Reply Quote 0
          • S
            spazio
            last edited by

            Nop, still have the same problem and it gets worst. I took another machine, did a completly new install from dist cd and the same problem occurs. The default deny rule block everything. I can't even get the packet to go tru once in a while like my other network.

            Here is my understanding of the problem, the packet are discarded  on a first come first served. It like if the default deny rule is the first, the packet is discarted so the other added rule do not apply.

            This is weird, nat is usually pretty much strait forward, is there somebody that does technical incident call service?

            1 Reply Last reply Reply Quote 0
            • D
              danswartz
              last edited by

              can you post your /tmp/rules.debug?

              1 Reply Last reply Reply Quote 0
              • T
                thafener
                last edited by

                hi danswartz

                here's mine as a example… renamed it to rules.txt

                Thx thafener

                rules.txt

                1 Reply Last reply Reply Quote 0
                • D
                  danswartz
                  last edited by

                  In a couple of places, you have rules saying {tcp udp} for a tcp service - get rid of the udp it just confuses things.  Also, your post refers to 192.168.0.10, but the rules are referencing 192.168.1.2 - is this an error, or did you change the IPs and not post that?  Anyway, this all looks correct - the only thing I can see as a possible issue (that might explain the inbound SSH request not getting through and not being blocked by PF) is snort.  I have stopped using snort myself, due to false positives that resulted in good hosts being blacklisted.  Could that be it?

                  1 Reply Last reply Reply Quote 0
                  • T
                    thafener
                    last edited by

                    Hi danswartz

                    Sorry I did not mean to confuse you, it was not the logfile of the threat starter but I have
                    exactly the same problem, I cannot access 192.168.1.2 in the LAN segment and found no lasting
                    solution so far.
                    Well I am not using snort but I will check the rest

                    Thx thafener

                    1 Reply Last reply Reply Quote 0
                    • D
                      danswartz
                      last edited by

                      Oh, sigh.  This is confusing.  I hadn't noticed I was dealing with two different posters :(  So, thafener, when you try to connect to ssh from outside, is it blocked by the default rule or it just goes nowhere?

                      1 Reply Last reply Reply Quote 0
                      • T
                        thafener
                        last edited by

                        Sorry for all that mess danswartz I do not think that the ssh packages are blocked by the default rule as I can see
                        them pass in the firewall log but I cannot connect to the ssh host which is possible of course from the LAN side.
                        It is really confusing that I already "solved" this by making the SSH NAT rule the first one and it has been working
                        fine for a while but unfortunately the problem occured again.
                        I have a second PFsense system running in a different location and here it is the same with natting FTP.
                        I cannot access both boxes from here but I'' get back to this with a little more detailed log output tomorrow morning.

                        cheers thafener

                        1 Reply Last reply Reply Quote 0
                        • T
                          thafener
                          last edited by

                          Ok here's some output and some screenshots of this phenomenon…first of
                          all a packet capture of the WAN interface on Port 22...

                          08:09:08.760774 IP 217.71.243.136.1651 > 83.79.5.14.22: tcp 0
                          08:09:11.726431 IP 217.71.243.136.1651 > 83.79.5.14.22: tcp 0
                          08:09:17.742044 IP 217.71.243.136.1651 > 83.79.5.14.22: tcp 0
                          

                          Please find the screenshots of the NAT rule and the Log viewer attached
                          below…

                          fwlog1.jpg
                          fwlog1.jpg_thumb
                          fwrule1.jpg
                          fwrule1.jpg_thumb

                          1 Reply Last reply Reply Quote 0
                          • D
                            danswartz
                            last edited by

                            Are you absolutely 100% positive there is no trace of the connection on LAN side?  Can you run a capture there too?

                            1 Reply Last reply Reply Quote 0
                            • T
                              thafener
                              last edited by

                              I have made a captore in full detail but could not find packets on port 22 for host 192.168.1.2  :-\

                              1 Reply Last reply Reply Quote 0
                              • D
                                danswartz
                                last edited by

                                Can you capture anything at all on the LAN side involving 192.168.1.2 or port 22 (e.g. two captures.)

                                1 Reply Last reply Reply Quote 0
                                • T
                                  thafener
                                  last edited by

                                  I have scanned but only the capture for 192.168.1.2 produced output, sadly not for Port 22.
                                  There is no traffic on port 22 coming through the box though it should according to the setup…

                                  capture_host.txt

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    danswartz
                                    last edited by

                                    If you try a connect (which hangs I assume, waiting for the SYN to be replied to), what shows up in the pfsense state table?

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      thafener
                                      last edited by

                                      Yes there is something showing up in the state table, I was have used the host I am connecting from as a filter… see screenshot

                                      statetable.jpg
                                      statetable.jpg_thumb

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        danswartz
                                        last edited by

                                        Hmmm, this is odd.  Is it possible to do a capture on the ssh server itself?  I am not sure I trust the capture on the pfsense.

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          thafener
                                          last edited by

                                          Well I used wireshark on the target host running Ubuntu and there were no SSH packages from the Pfsense box to the target host.

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            danswartz
                                            last edited by

                                            okay, thanks.  boy, is that weird.  question: i assume this doesn't work at all?  if correct, does a reboot of the pfsense bring it back?  also, do you have sshd enabled on the pfsense?  if so, does disabling it "fix" this (i am not recommending that as a fix, just trying to isolate things.)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.