Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall NAT Port Forward Help

    Scheduled Pinned Locked Moved Firewalling
    17 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      JoelLinn
      last edited by

      ahhhh
      so your pfSense is not your router in this case  ;D took some time…...

      In your screenshot there is no Redirect target port entered. You should enter SSH there to.

      But even if you do that there is a possibility that your Router doesn't allow connections from any network(only local or known nets).
      If that's the case, you should consult your router documentation.

      1 Reply Last reply Reply Quote 0
      • C
        cpatte7372
        last edited by

        Joel

        Thanks for responding.

        May be the I didn't explain myself well as the other responders didn't come close to understanding what I am trying to achieve.

        Anyway, I have added SSH to Redirect target port.

        So, when I ssh to 74.65.78.12 should I be directed to 192.168.1.3?

        If so, it doesn't work

        1 Reply Last reply Reply Quote 0
        • C
          cpatte7372
          last edited by

          Hi,

          I have to appreciate that members here aren't too familiar with routers, therefore I'll provide another sample. This time I would like to RDP to a remote Windows Workstation, ip address 192.168.1.2, sitting behind my firewall

          The pfSense firewall has an WAN ip  address (not real) 74.75.89.1

          I have configured the firewall NAT Porward Edit as shown in the image.

          Can someone please tell me why this won't work…

          asa.PNG
          asa.PNG_thumb

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Can someone please tell me why this won't work…

            What's the corresponding firewall rule look like?

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • C
              cpatte7372
              last edited by

              Derelict

              See image for corresponding firewall

              image.jpg
              image.jpg_thumb

              1 Reply Last reply Reply Quote 0
              • C
                cpatte7372
                last edited by

                Oops

                image.jpg
                image.jpg_thumb

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Should work fine.  Does 192.168.1.2 default route back to pfSense?  Does it allow inbound MSRDP from "unfriendly" networks?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • C
                    cpatte7372
                    last edited by

                    Hi derelict

                    192.168.1.2 doesn't default to pfsense. However, I an RDP to from unfriendly networks.

                    I don't undersatnd - it should work

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Well, the return traffic is going to go wherever the default route tells it to go.  If that's not the router node with the NAT translation it's not going to work.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • C
                        cpatte7372
                        last edited by

                        The ofsense LAN address is 192.168.1.1, the public address is 74.x.x.x. Are you saying that the default route on the Workstation should be 192.168.1.1?

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Yes.  If you want this to work it has to be.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • C
                            cpatte7372
                            last edited by

                            Ok,

                            Going to get out of bed and try now..

                            Back in 5mins

                            1 Reply Last reply Reply Quote 0
                            • C
                              cpatte7372
                              last edited by

                              Brilliant

                              That worked

                              Thanks Derelict

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.