WAN access to IP camera fails with pfSense

[eiger3970]

Thank you for the replies.
1. Camera is set on port 88, so port forward to 88 is good.

2. Destination Address is the LAN IP. That is the local IP of the camera being 192.168.1.200. Which WAN IP do you mean? The WAN as my network as a router with public WAN IP > router LAN > Switch > camera LAN IP. I can't understand how putting in the public WAN IP on the camera would work?

3. The settings are greyed out and I can't click on the Eidt Firewall rule > Source > Type: any.

4. By what address? I enter in my mobile when within the local network router Wi-Fi, 192.168.1.200:88.

[Derelict]

Please read:

In the NAT rule the "Destination" needs to be "WAN address".  This is NOT the address of your internal host.  This is the DESTINATION address of the inbound connection request.  "WAN address"

I saved and applied pfSense, but no connection in a remote browser with address: http://WANIP:88.

Yes.  It didn't work because that WANIP address needs to be the destination in your NAT rule…

The Redirect target IP is what address the connection is NAT translated to.  Your internal IP address for your camera.

And no, you can't edit the firewall rule because it is a tracked rule from the NAT entry.  edit the NAT rule and changes will be automatically applied to the firewall rule.

[SOE LINN HTIKE]

Hi There,

I also getting same problem with you. Your problem solved already? If solved, please guide me how to solve it?

Many Thanks,
Soe

[eiger3970]

Well, fixed last week after port forwarding correctly, then using the command $ ssh user@publicWANIP -p portNumber.
However this week, the same commands fail and I receive the error:
ssh: Could not resolve hostname publicWANIP: nodename nor servname provided, or not known.

Any suggestions please?

[Derelict]

What are you really typing?  If a "hostname" matches the proper format of an IP address, name resolution isn't done.

Not sure if forward (A record) and reverse (corresponding PTR record) have to match.

If you have really set up a host called "publicWANIP" then you need to look at your DNS infrastructure and figure out why it's now failing to resolve.

[eiger3970]

Hello, when I type publicWANIP, I mean an IP address like 60.225.230.2.
E.g. In Terminal > $ ssh root@60.225.230.2 -p 8063 > Enter.
I don't think A record or DNS has anything to do with this…this is not for a webserver.

[Derelict]

ssh: Could not resolve hostname publicWANIP

That's DNS.  DNS resolves hostnames.

This should fail in the same way:

$ ssh root@kjsdksjfhs.sdfsdfsdf.sdfsdfsdf -p 8022
ssh: Could not resolve hostname kjsdksjfhs.sdfsdfsdf.sdfsdfsdf: nodename nor servname provided, or not known

And it does.

[eiger3970]

Thanks.
So, I tested computer1 locally and LAN IP was different.
Computer2 had correct LAN IP though.

So today, from a remote computer:
Remote browser to computer1 error: This webpage is not available.
Remote browser connects to computer2 and loads page.
Ssh to computer1 error: Connection refused.
Ssh to computer2 error: Connection closed by remote host.

Port forwards seem correct with pfSense port forward to:
computer1 port 8061 (I didn't change the computer's listening port…perhaps I should, but not sure how to on Ubuntu server 14.04.1 LTS)?
computer2 port 8063 (I changed the computer's listening port from 80 to 8063).

[Derelict]

I really don't have a good picture regarding what you're trying to do or what's not working exactly.

[eiger3970]

This might clarify my possible misunderstanding of how port forwards work and whether I have pfSense and the LAN computers configured correctly?
I think I'm missing a step to allow remote access to 3 local computers.

pfSense port forward I set computer1IP:portNumber1, computer2IP:portNumber2, computer3IP:portNumber3.
Then when I SSH to computer1, I use $ ssh computer1UserName@computer1IP -p computer1PortNumber.
The pfSense router then sends any received SSH traffic on port 22 to the relevant port.

Do I need to change the port number the LAN computer listens on?
That is, port 80 to portXYZ?

[Derelict]

Port forwards are usually used to translate an external IP:port to an internal IP:Port.  Say your external IP address (from your ISP that can accept incoming connections from the entire internet) is 74.75.76.77.  You have 3 SSH servers on your LAN all listening for ssh connections on port 22.  Those hosts are 192.168.0.23, 24, and 25.

You could set up the following NAT port forwards:

74.75.76.77:8022 -> 192.168.0.23:22
74.75.76.77:8023 -> 192.168.0.24:22
74.75.76.77:8024 -> 192.168.0.25:22

Then from outside, to connect to the second host, you would ssh -p 8023 host2user@74.75.76.77

[eiger3970]

Thank you for the clarification.
I think I have mine correct then.
There's no need to change the LAN computer's listening port of 80, which I was confused with.

However, having my LAN computer's setup like that, I still receive the errors:
Browser:
No remote browser access to security server on publicWANIP:8061.
Remote browser access to security server on publicWANIP:8063.

SSH:
$ ssh ubuntu@publicWANIP -p 8061
ssh: connect to host publicWANIP port 8061: Connection refused
$ ssh ubuntu@publicWANIP -p 8063
ssh_exchange_identification: Connection closed by remote host

TeamViewer:
TeamViewer to 192.168.1.40 blue, but won’t connect.
Now TeamViewer to 192.168.1.40 connects, but 192.168.1.120 turned off?
TeamViewered into 192.168.1.120, the remote connection turned off.

Traffic analyser:
Tested packet capture: LAN computer > pfSense > Diagnostics > Packet Capture > Start > remote computer (I'm on this) > Terminal  > $ssh ubuntu@publicWANIP -p portNumber > Enter > LAN computer > pfSense > Stop.
No packets reaching the pfSense WAN.

I'm now stuck remotely and will need to physically go to the local computers for access, to try again tomorrow.