Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall NAT Port Forward Help

    Scheduled Pinned Locked Moved Firewalling
    17 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cpatte7372
      last edited by

      Hi guys,

      Thanks for responding.

      I take your point regarding telnet. Therefore, I will go with SSH.

      So I need to SSH to a router via pfsense.

      I might not be explaining myself well enough, but to be honest I assumed most people on this forum would have worked with Cisco routers, switches etc…

      I can't be the first person asking this question.

      I would like to remotely connect to a router that is behind my pfSense firewall. The router has the private address 192.168.1.3.

      Clearly I can't SSH onto the router from the Internet to the private address. My pfSense firewall has a WAN address, say 74.65.78.12 and the router with the private address 192.168.1.3 sits behind the pfSense with the WAN ip address, 74.65.78.12.

      I have configured the firewall:nat as shown in the image, but it doesn't work.

      Can someone please help me.

      Carlton

      asa.PNG
      asa.PNG_thumb

      1 Reply Last reply Reply Quote 0
      • J
        JoelLinn
        last edited by

        ahhhh
        so your pfSense is not your router in this case  ;D took some time…...

        In your screenshot there is no Redirect target port entered. You should enter SSH there to.

        But even if you do that there is a possibility that your Router doesn't allow connections from any network(only local or known nets).
        If that's the case, you should consult your router documentation.

        1 Reply Last reply Reply Quote 0
        • C
          cpatte7372
          last edited by

          Joel

          Thanks for responding.

          May be the I didn't explain myself well as the other responders didn't come close to understanding what I am trying to achieve.

          Anyway, I have added SSH to Redirect target port.

          So, when I ssh to 74.65.78.12 should I be directed to 192.168.1.3?

          If so, it doesn't work

          1 Reply Last reply Reply Quote 0
          • C
            cpatte7372
            last edited by

            Hi,

            I have to appreciate that members here aren't too familiar with routers, therefore I'll provide another sample. This time I would like to RDP to a remote Windows Workstation, ip address 192.168.1.2, sitting behind my firewall

            The pfSense firewall has an WAN ip  address (not real) 74.75.89.1

            I have configured the firewall NAT Porward Edit as shown in the image.

            Can someone please tell me why this won't work…

            asa.PNG
            asa.PNG_thumb

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Can someone please tell me why this won't work…

              What's the corresponding firewall rule look like?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • C
                cpatte7372
                last edited by

                Derelict

                See image for corresponding firewall

                image.jpg
                image.jpg_thumb

                1 Reply Last reply Reply Quote 0
                • C
                  cpatte7372
                  last edited by

                  Oops

                  image.jpg
                  image.jpg_thumb

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Should work fine.  Does 192.168.1.2 default route back to pfSense?  Does it allow inbound MSRDP from "unfriendly" networks?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • C
                      cpatte7372
                      last edited by

                      Hi derelict

                      192.168.1.2 doesn't default to pfsense. However, I an RDP to from unfriendly networks.

                      I don't undersatnd - it should work

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Well, the return traffic is going to go wherever the default route tells it to go.  If that's not the router node with the NAT translation it's not going to work.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • C
                          cpatte7372
                          last edited by

                          The ofsense LAN address is 192.168.1.1, the public address is 74.x.x.x. Are you saying that the default route on the Workstation should be 192.168.1.1?

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Yes.  If you want this to work it has to be.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • C
                              cpatte7372
                              last edited by

                              Ok,

                              Going to get out of bed and try now..

                              Back in 5mins

                              1 Reply Last reply Reply Quote 0
                              • C
                                cpatte7372
                                last edited by

                                Brilliant

                                That worked

                                Thanks Derelict

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.