Dynamic public IP to LAN client.

Suppo · Nov 22, 2013, 2:34 PM

Hello.

I have this type of scenario : I got PFsense running on old PC with dual NIC as a firewall and I have couple of servers behind it in range 192.168.1.10 - 192.168.1.14.
So, I would like to assign a DYNAMIC (since my ISP only provides dynamic IP's from their DHCP) IP address to one of my servers which is a webserver. I've googled alot and havent find example setup or tutorial how's this done with Dynamic public IPs from dhcp.

Or, is it possible to forward traffic coming from DynDNS to that webserver LAN IP (Example when client types ****.freedns.org, firewall forwards him to web server located at LAN address 192.168.1.11)

So in a nutshell : I want to have my web server be available behind PFsense while having a Dynamic WAN IP

Thank you.

johnpoz · Nov 22, 2013, 4:06 PM

Do you need for say something.freedns.org to go to server .10 and other.no-ip.net to go to .11 ? Based on the name and not the Port?

If not - then you just forward the ports for your websever.. I would assue http and https (80 and 443) to the webserver behind pfsense.

So you create a portforward to 192.168.1.10 for http and https, let pfsense link and create the wan rule (default setting) and your good to go. When someone goes to something.freedns.org that points to your pfsense public IP. PFsense will forward that traffic to your webserver on .10

Now if you have other.no-ip.net pointing to your IP, that would also be forward to your webserver and your webserver could use the host headers to serve up a different site.

Your problem comes in if you want to send one fqdn to .10 and other fqdn to .11 without using say fqdn:differentport there is no way for pfsense to do this. You would have to run a reverse proxy on pfsense to handle sending to IPs behind pfsense based on fqdn. Since you only have one public ip?

Suppo · Nov 22, 2013, 4:36 PM

"Do you need for say something.freedns.org to go to server .10 and other.no-ip.net to go to .11 ?"
Exactly, this is what I would like to achieve

Edit : My ISP provides me 5 public IP addresses from DHCP server

johnpoz · Nov 22, 2013, 5:14 PM

So pfsense pulls multiple IPs? If you have multiple IPs on pfsense you can do it.

If you get them with dhcp - easy way might be to put a switch between pfsense and isp device so that you can have multiple interfaces on pfsense that are wan connected. This way each interface would have its own public IP you could setup dyn dns for and then forward to whatever you wanted behind pfsense.

I don't believe its possible, or I sure don't know how to do it off the top grab vips on pfsense via dhcp?

Suppo · Nov 22, 2013, 6:26 PM

Not currently all machines behind PFsense are 192.168..

Is there anyway to 'bypass' NAT and PFsense DHCP with one machine and assign IP from ISP's DHCP server
Attached a pic about my idea.

Of couse I would achieve this by connecting this machine outside of pfsense network, straight to cable modem, but is there anyway to do it with pfsense (note : cable does not have NAT or DHCP server, just bridges)

johnpoz · Nov 22, 2013, 7:42 PM

don't see any picture ;)

But you could setup pfsense as transparent/bridge firewall – search the forum, lots of discussion on that - then your boxes behind pfsense should get an IP from your isp.

Suppo · Nov 22, 2013, 7:56 PM

http://www.upload.ee/image/3721713/Pic.jpg
here's link :D

Yeah, I understand this option, but I'd like to have private network for local file server and print server

johnpoz · Nov 23, 2013, 12:13 PM

So do these addresses have to be dhcp? Why can you not just assign them statically to vips? I would have to assume you have a /29 ? Or do you just get random IPs that are not part of same /29 ?

Guess you could put more nics in pfsense, connect a switch to your cable modem and then connect your nics and get their own IPs that way. Then do with what you will.

I don't know of any other way to get multiple IPs via dhcp other than other nics, I do not believe pfsense support subinterfaces that would have their own mac and be able to get their own dhcp ip.

Your question is actually not really related to port forwarding or nat, but the use of multiple IPs on the public interface that are assigned via dhcp. You might want to start a new thread with that as the subject and question.

Suppo · Nov 23, 2013, 11:03 PM

Yup, thanks for the help :)

I have already ordered 3 extra nics for my pfsense setup, I'll just keep my webserver outside of pfsense setup for now. Damn. my setup is def. gonna be a wiring hell due all of these cards and servers :D

Oh and also, I can assign static IP to vips for a while, but when lease time ends I'm screwd. Also my dynamic IP is unpredicable since it can be from various ranges. Such a shame my ISP doesn't offer static IPs for 'home' users

johnpoz · Nov 23, 2013, 11:23 PM

"static IPs for 'home' users"

I don't get serving up services out of a home connection.. What is your upload speed? What does it cost in power to run the things, etc. Wouldn't it just be easier host your services at an actual DC with a host? Be it vps, dedicated hardware, even a colo?

Suppo · Nov 25, 2013, 11:47 PM

100/100 Fiber. Of course it's easier to host stuff on VPS, but the thing here is I got those servers for free and I'm just playing around with them, exploring etc etc, so nothing serious really, this is just a 'hobby'

Derelict · Nov 26, 2013, 10:57 PM

If you have a managed switch you could create VLAN interfaces on your LAN interface and bridge them with the WAN. You could then tag that VLAN through to your server and it would effectively be on the WAN side and should be able to pull DHCP from the ISP.

Suppo · Nov 27, 2013, 12:14 AM

Yeah, I got 3com 4210 switch. I'll try that asap. Thanks for the tip :)