Redirection Traffic

[Big_Bill]

Please HELP !!!

[Gertjan]

The post above from @johnpoz does exactly what you were asking for.

[Big_Bill]

@gertjan dosen't work

Firewall -> NAT -> Port Forward

Interface : LAN
Protocol : TCP/UDP
Source : *
Destination : - type = Single host , Adress/Mask = ip public
Destination port range : http
Redirect target IP : 192.168.1.X
Redirect target port : https
NAT reflection : Use system default

[Gertjan]

This :
@big_bill said in Redirection Traffic:

Destination port range : http
Redirect target IP : 192.168.1.X
Redirect target port : https

will never work.

redirecting http to https is a fail ... and needles to ask : this will never work.

So I tried what @johnpoz said :

192.168.2.2 (port 80 - no SSL) is a GUI access of one of my AP.

It works !! I typed :

and the AP GUI page opened

I'm visiting from my LAN, a device with IP 192.168.1.100
192.168.2, the AP, is on my OPT1 interface

Again : forget about redirecting https. Learn about the word MITM (Google it up - have a look at Wiki pages or search on this forum, and you'll see).

[johnpoz]

Its not going to work for https.. And if you redirect to the same lan, even if http I don't think it will work because the client will see answer from wrong IP/mac.. When you forward it through router you have go between and to the client it looks like came from 8.8.8.8 in my scenario..

But when are on same network you end up with this... I changed the port forward to point to 192.168.9.8

As you see .100 sent to 8.8.8.8 but it got answer from 192.168.9.8 - which sorry its not going to accept..

So for something like this to work with http even - again https is not going to work.. Unless the web server your sending to has the public IP your sending too i the SAN AND -- the client trusts the CA that signed that cert.

You would have to source nat the traffic to be looking like it came from pfsense IP on this network, and then pfsense would have to send it back to your client looking like it came from 8.8.8.8..

Why exactly are you looking to do this? Maybe your just going down the wrong rabbit hole for whatever issue your trying to fix?

[Big_Bill]

@gertjan i tried with http

the browser saied : ERR_CONNECTION_TIMED_OUT

[Big_Bill]

@johnpoz

My server sends URLs containing URLs using its local IP address, but our external clients do not have access with this IP.

i would perform the redirection:

outside (WAN), redirect to our public IP
in local (LAN), redirect to our local IP

i have configure the server to send the notification with the public ip (for the external client)

but in the lan side ; i can't access to this IP

[elkato]

If you have a local server with private IP, clients on Internet must connect to a public IP, and you need to NAT that to your private IP server.
And clients in the local lan, must connect to private IP directly.

To use same hostname in both cases like "host.domain.tld" you must setup your DNS, and you can override that entry to solve to private IP for LAN users, but to public IP for external users.

[johnpoz]

So all you need it port forward for this to work if clients are hitting your public IP on your wan to your lan.

I took this as you were wanting local users to do this.. If this is outside users this is simple port forward. If you want your users to hit your OUTSIDE ip and get reflected back in that is nat reflection.

But the better solution is to use dns, and have your users resolve www.whatever.tld that points to your public IP and have that resolve locally to your server on your private IP address..

What sort of notification are you sending?? you should never hard code IP.. Use FQDN..

[Big_Bill]

@elkato How do this with pfsense

[Gertjan]

NAT : https://www.netgate.com/docs/pfsense/nat/forwarding-ports-with-pfsense.html
DNS : Start here https://www.netgate.com/docs/pfsense/dns/unbound-dns-resolver.html