Dynamic public IP to LAN client.

johnpoz

Do you need for say something.freedns.org to go to server .10 and other.no-ip.net to go to .11 ? Based on the name and not the Port?

If not - then you just forward the ports for your websever.. I would assue http and https (80 and 443) to the webserver behind pfsense.

So you create a portforward to 192.168.1.10 for http and https, let pfsense link and create the wan rule (default setting) and your good to go. When someone goes to something.freedns.org that points to your pfsense public IP. PFsense will forward that traffic to your webserver on .10

Now if you have other.no-ip.net pointing to your IP, that would also be forward to your webserver and your webserver could use the host headers to serve up a different site.

Your problem comes in if you want to send one fqdn to .10 and other fqdn to .11 without using say fqdn:differentport there is no way for pfsense to do this. You would have to run a reverse proxy on pfsense to handle sending to IPs behind pfsense based on fqdn. Since you only have one public ip?

Suppo

"Do you need for say something.freedns.org to go to server .10 and other.no-ip.net to go to .11 ?"
Exactly, this is what I would like to achieve

Edit : My ISP provides me 5 public IP addresses from DHCP server

johnpoz

So pfsense pulls multiple IPs? If you have multiple IPs on pfsense you can do it.

If you get them with dhcp - easy way might be to put a switch between pfsense and isp device so that you can have multiple interfaces on pfsense that are wan connected. This way each interface would have its own public IP you could setup dyn dns for and then forward to whatever you wanted behind pfsense.

I don't believe its possible, or I sure don't know how to do it off the top grab vips on pfsense via dhcp?

Suppo

Not currently all machines behind PFsense are 192.168..

Is there anyway to 'bypass' NAT and PFsense DHCP with one machine and assign IP from ISP's DHCP server
Attached a pic about my idea.

Of couse I would achieve this by connecting this machine outside of pfsense network, straight to cable modem, but is there anyway to do it with pfsense (note : cable does not have NAT or DHCP server, just bridges)

johnpoz

don't see any picture ;)

But you could setup pfsense as transparent/bridge firewall – search the forum, lots of discussion on that - then your boxes behind pfsense should get an IP from your isp.

Suppo

http://www.upload.ee/image/3721713/Pic.jpg
here's link :D

Yeah, I understand this option, but I'd like to have private network for local file server and print server

johnpoz

So do these addresses have to be dhcp? Why can you not just assign them statically to vips? I would have to assume you have a /29 ? Or do you just get random IPs that are not part of same /29 ?

Guess you could put more nics in pfsense, connect a switch to your cable modem and then connect your nics and get their own IPs that way. Then do with what you will.

I don't know of any other way to get multiple IPs via dhcp other than other nics, I do not believe pfsense support subinterfaces that would have their own mac and be able to get their own dhcp ip.

Your question is actually not really related to port forwarding or nat, but the use of multiple IPs on the public interface that are assigned via dhcp. You might want to start a new thread with that as the subject and question.

Suppo

Yup, thanks for the help :)

I have already ordered 3 extra nics for my pfsense setup, I'll just keep my webserver outside of pfsense setup for now. Damn. my setup is def. gonna be a wiring hell due all of these cards and servers :D

Oh and also, I can assign static IP to vips for a while, but when lease time ends I'm screwd. Also my dynamic IP is unpredicable since it can be from various ranges. Such a shame my ISP doesn't offer static IPs for 'home' users

johnpoz

"static IPs for 'home' users"

I don't get serving up services out of a home connection.. What is your upload speed? What does it cost in power to run the things, etc. Wouldn't it just be easier host your services at an actual DC with a host? Be it vps, dedicated hardware, even a colo?

Suppo

100/100 Fiber. Of course it's easier to host stuff on VPS, but the thing here is I got those servers for free and I'm just playing around with them, exploring etc etc, so nothing serious really, this is just a 'hobby'

Derelict

If you have a managed switch you could create VLAN interfaces on your LAN interface and bridge them with the WAN. You could then tag that VLAN through to your server and it would effectively be on the WAN side and should be able to pull DHCP from the ISP.

Suppo

Yeah, I got 3com 4210 switch. I'll try that asap. Thanks for the tip :)