NAT Reflection broken since upgrade to 2.2
-
Why would you send 80 to RDP port 3389?? RDP can use udp so that for sure could have issues.
Also seeing that your blocking rfc1918 on your wan.. So coming from a rfc1918 address, hitting your public - I would think that would be blocked right there from nat reflection working.
-
@johnpoz The reason I send 80->RDP is that I sometimes have to access RDP from networks that stupidly block everything but 80 and 443. It's a simple yet effective hack.
I removed both the rfc1918 and the bogon blocks on WAN (they were already off for my secondary WAN_ADSL) and it had no effect.
I just noticed that in NAT+Proxy mode sometimes a little bit comes through (e.g. on an HTTP connection some of a page will start loading and then fail). I'm wondering if the Proxy app is crashing or not working properly. Is there any way to diagnose this?
-
Do those rules even get loaded? I cannot see how's -10 a valid destination port.
-
@doktornotor That's a very old rule that probably got corrupted by upgrading pfSense over the years. I deleted it and it made no difference.
-
With the amount of port forwards, I would not touch the NAT + proxy stuff at all.
The NAT + proxy mode uses a helper program to send packets to the target of the port forward. It is useful in setups where the interface and/or gateway IP used for communication with the target cannot be accurately determined at the time the rules are loaded. Reflection rules are not created for ranges larger than 500 ports and will not be used for more than 1000 ports total between all port forwards. Only TCP and UDP protocols are supported.
Also, the stuff looks just all wrong??? Look at the NAT ports. 25 -> *; 443 -> *; 993 -> * ?! Etc. WTH.
-
@doktornotor I have no particular affinity for proxy mode, that's simply what used to work. I agree that Pure NAT is the better way to go, but I have no idea where to begin with diagnosing the fact that it doesn't work.
-
See the previous post! Why is there "any" (*) in the NAT ports? That's just not right. You should set the Redirect target port properly. This seems even impossible to set up via the GUI.
-
yeah you can not have * for dest nat port and expect it to work..
Clean all that nonsense and which reflection is not working..
You want the correct way to admin your network when they only allow 80 and 443.. You VPN over 443 and there you go full access to anything you need on your network..
-
@doktornotor, @johnpoz Thanks for pointing out the * in the NAT rules. I'm not sure how that happened but I went through them all and fixed them. It still didn't help.
-
Well, I simply do not think your configuration state is anywhere near sane. Things like the above are really impossible to configure via the GUI. God knows what else got screwed. Would flush this down the drain and restart from scratch.
