Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall NAT Port Forward Help

    Scheduled Pinned Locked Moved Firewalling
    17 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cpatte7372
      last edited by

      Hi,

      I have to appreciate that members here aren't too familiar with routers, therefore I'll provide another sample. This time I would like to RDP to a remote Windows Workstation, ip address 192.168.1.2, sitting behind my firewall

      The pfSense firewall has an WAN ip  address (not real) 74.75.89.1

      I have configured the firewall NAT Porward Edit as shown in the image.

      Can someone please tell me why this won't work…

      asa.PNG
      asa.PNG_thumb

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Can someone please tell me why this won't work…

        What's the corresponding firewall rule look like?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • C
          cpatte7372
          last edited by

          Derelict

          See image for corresponding firewall

          image.jpg
          image.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • C
            cpatte7372
            last edited by

            Oops

            image.jpg
            image.jpg_thumb

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Should work fine.  Does 192.168.1.2 default route back to pfSense?  Does it allow inbound MSRDP from "unfriendly" networks?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • C
                cpatte7372
                last edited by

                Hi derelict

                192.168.1.2 doesn't default to pfsense. However, I an RDP to from unfriendly networks.

                I don't undersatnd - it should work

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Well, the return traffic is going to go wherever the default route tells it to go.  If that's not the router node with the NAT translation it's not going to work.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • C
                    cpatte7372
                    last edited by

                    The ofsense LAN address is 192.168.1.1, the public address is 74.x.x.x. Are you saying that the default route on the Workstation should be 192.168.1.1?

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Yes.  If you want this to work it has to be.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • C
                        cpatte7372
                        last edited by

                        Ok,

                        Going to get out of bed and try now..

                        Back in 5mins

                        1 Reply Last reply Reply Quote 0
                        • C
                          cpatte7372
                          last edited by

                          Brilliant

                          That worked

                          Thanks Derelict

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.