pfsense doesn't block port on wan
-
I explained exactly what is going on based on what you have posted.
I cannot explain to you that which is not shown. You are posting rules/screen shots for one thing, getting a complete explanation, then saying something else isn't working.
Does the table in Diagnostics > Tables contain the IP addresses you expect to be blocked?
Please show everything about that alias and the rules in question.
-
Today I will have a screen recorder and will attach the link here for your review.
-
Just post the rule sets, the contents of the alias, and what you think should be happening. Not going to watch movies.
-
Firewall / Rules / WAN Destionation is "any"
Alias
Firewall / NAT / Port Forward
Firewall / Rules / WAN
Port check
Firewall / Rules / WAN Destionation is "WAN Address"
Port check
When Destination in WAN Rules is "any", pfsense blocks, but if Destionation is "WAN Address", pfsense doesn't block.
-
@emammadov said in pfsense doesn't block port on wan:
When Destination in WAN Rules is "any", pfsense blocks, but if Destionation is "WAN Address", pfsense doesn't block.
That is, as already explained above, because the NAT port forward has already changed the destination address.
Btw. opening RDP to the WAN is plain stupid, use a VPN for remote administration.
-
@grimson But it has been worked in 2.4.3p1 version.
-
No it didn't - atleast not the way you think it was..
-
Then, you mean, if I want to block source ip, I have to choose "any" in Destination address and if I allow source ip to my pfsense, then i have to choose "WAN Address" in Destination address, right?
-
Post your rules HOW they are set, and what is not happening.. Lan rules have ZERO to on what happens inbound to the WAN..
Your running pfblocker - and you have rules in floating that block traffic.. If so then they could be blocking access to your port forward..
Unless you are using a VIP address on your wan, port forward will always be to wan address - which is the default. It will auto create the firewall rule for you by default. If you to limit to a specific alias as source that has zero to do with the dest address and can be be used in your port forward rule.
-
I have sent you private message. By the way, I am using pfblocker, but Action in pfblocker is "Alias Native". I don't use floating rules.
-
Dude I am not going to watch a freaking movie.. You scrolling around your rules makes it IMPOSSIBLE to see what might or might not be wrong.
Its this simple post your port forward, post your wan rules. Post your floating rules. (if nothing in there - still post them).. State what doesn't work.
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.htmlJust because your port test says not open doesn't mean the port forward didn't work btw. Maybe your client not listening or sending back RST because it doesn't allow rdp from IP other than its local lan, etc.. Run through the troubleshooting guide..
Port forwarding to 3389 is this simple.
Once I remove the rule - bam its BLOCKED!! You have to kill any open states that might exist..
-
You approached. Now create a rule on wan interface, select block in action, add a public ip address you know to the source, choose "wan address " in destination, save and drag it to the above of the rule you created for rdp. You will see that ip addresses in source still can access your server via rdp, but if you select "any" in destination in the rule of wan address, pfsense will block the traffic from that public ip address.
-
Man. NAT HAPPENS BEFORE FIREWALL RULES ARE EVALUATED! WAN ADDRESS WILL NOT MATCH AS A DESTINATION ADDRESS FOR TRAFFIC MATCHING THE PORT FORWARD! THE DESTINATION ADDRESS HAS BEEN TRANSLATED TO THE SERVER ADDRESS!
-
As Derelict has been trying to tell you for this whole thread. Now create your firewall rule with dest of your IP of your nat, ie 192.168.x.x
Put that above your rule that allows it.. And that IP would be blocked.
