• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Firewall Rule to Allow RDP from WAN to LAN......Need help

Scheduled Pinned Locked Moved Firewalling
76 Posts 7 Posters 10.6k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    Derelict LAYER 8 Netgate
    last edited by Derelict Sep 24, 2019, 3:17 AM Sep 24, 2019, 3:15 AM

    Don't set a source port.

    You had to go pretty deep into advanced settings and ignore warnings to get to that point.

    I'd have to see a diagram to see if setting the source network of LAN net is applicable. It probably should not be set either.

    Chattanooga, Tennessee, USA
    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
    Do Not Chat For Help! NO_WAN_EGRESS(TM)

    1 Reply Last reply Reply Quote 0
    • D
      DINU
      last edited by Sep 24, 2019, 3:20 AM

      Source port is not set it is any (*)

      Let me check the advanced settings...

      1 Reply Last reply Reply Quote 0
      • D
        Derelict LAYER 8 Netgate
        last edited by Derelict Sep 24, 2019, 3:22 AM Sep 24, 2019, 3:21 AM

        How abouts you post an actual screen capture of the rule instead of a textual approximation of the same.

        And there are two parts to a port forward. The NAT/PAT rule and the firewall rule. Best you post both.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • D
          DINU
          last edited by Sep 24, 2019, 3:33 AM

          Attach firewall rule & NAT == > WAN
          Port_forward_WAN.jpg Firewall_Rule_WAN.jpg

          1 Reply Last reply Reply Quote 0
          • D
            Derelict LAYER 8 Netgate
            last edited by Derelict Sep 24, 2019, 3:53 PM Sep 24, 2019, 3:51 PM

            OK so you have a port forward on WAN with a destination address of LAN Net. How exactly do you expect that to work?

            Why did you set the rule association to Pass? No docs state to do that.

            And you are forcing the connection out WAN by setting that gateway on the rule.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • D
              DINU
              last edited by Sep 24, 2019, 4:06 PM

              Any update ???

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz Sep 24, 2019, 4:10 PM Sep 24, 2019, 4:09 PM

                Update? How exactly do you expect such a mess to work??

                If you have questions about what something is or means, you need to ask.. Don't just go random clicking shit and picking stuff from the drop down..

                To create a port forward in pfsense, really the only thing you have to touch is the port, redirect port, and the IP you want to send it too.. Everything else is going to be pretty much default.

                And let the port forward create the firewall rule - which is default..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • C
                  chpalmer
                  last edited by chpalmer Sep 24, 2019, 4:14 PM Sep 24, 2019, 4:13 PM

                  Turn the firewall off on the machine that your are trying to RDP into.

                  It will treat anything outside its own subnet as public and block it.

                  Your post with the graphic looks correct although MS recommends a TCP/UDP connection. I do not believe I ever have though. I normally do not leave such a rule in place any longer than I need it.

                  Triggering snowflakes one by one..
                  Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz Sep 24, 2019, 4:19 PM Sep 24, 2019, 4:18 PM

                    ^ looks correct? What are you looking at? It sure not the mess he posted.. Has gateway set on his wan rule, the dest is Lan Net vs wan address in his port forward.

                    Here is the 3 things that need to be touched to port forward rdp

                    portforward.png

                    That is it, don't touch anything else - the defaults are all you need. It will create the firewall rule for you. You just need to make sure you turn off the default block rfc1918 rule because your source is actually rfc1918.

                    edit: Lets get tcp working before he worries about having a UDP connection ;) But sure if he wanted he could change it from default of tcp to tcp/udp.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • D
                      DINU
                      last edited by Sep 24, 2019, 4:33 PM

                      I have tried with NAT Rule that did not helped so used PASS and took the screen shot at that time..

                      In one of the forum in netgate to mentioned gateway instead of default so I have tried that as well whether it may help...

                      1 Reply Last reply Reply Quote 0
                      • D
                        Derelict LAYER 8 Netgate
                        last edited by Sep 24, 2019, 4:35 PM

                        List of things to check is here:

                        https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Sep 24, 2019, 5:09 PM Sep 24, 2019, 5:08 PM

                          It should take you like 2 minutes top to trouble shoot a port forward..

                          Sniff on wan, do you see traffic to 3389? Sniff on Lan - do you see pfsense sending 3389 on to IP you want to send it to..

                          If you do - your problem is prob firewall on host your sending too, maybe rdp isn't even listening? Maybe it is using a different gateway other than pfsense? Maybe where you wanted to send it is now on a different IP? etc. etc..

                          Troubleshooting a port forward does not mean randomly changing settings ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • M
                            MoonKnight
                            last edited by Sep 24, 2019, 5:12 PM

                            Hi,
                            And make sure you have enabled "Remote Desktop" on your computer you are trying to RDP :)

                            --- 24.11 ---
                            Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                            Kingston DDR4 2666MHz 16GB ECC
                            2 x HyperX Fury SSD 120GB (ZFS-mirror)
                            2 x Intel i210 (ports)
                            4 x Intel i350 (ports)

                            1 Reply Last reply Reply Quote 0
                            • D
                              DINU
                              last edited by Sep 26, 2019, 1:56 AM

                              Thanks friends for the help, I can able to access my Windows Machines from WAN to LAN..
                              Two things I have done one is enabled firewall rules in WAN and added route in my source machine (ie) in WAN network.

                              Firewall_Rule_WAN1.jpg

                              route add 192.168.30.0 mask 255.255.255.0 192.168.50.100

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by Sep 26, 2019, 9:16 AM

                                So you turned off NAT in pfsense?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                D 1 Reply Last reply Sep 26, 2019, 1:14 PM Reply Quote 0
                                • D
                                  DINU @johnpoz
                                  last edited by Sep 26, 2019, 1:14 PM

                                  @johnpoz

                                  Yes I have turned off NAT in pfsense...

                                  now I need help in configuring Open VPN for my mentioned design... to access my LAN network through Internet...

                                  Airtel Internet Modem -->Asus RT-AX88U Wireless Router --->PFsense-->LAN and DMZ..

                                  I need to do triple NAT here.. apart from doing this ... can you suggest some other good options...

                                  A 1 Reply Last reply Sep 26, 2019, 5:21 PM Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz Sep 26, 2019, 1:19 PM Sep 26, 2019, 1:19 PM

                                    Well if you turned off nat in pfsense, then you would need to route.. And you would really need to be connected via a transit network or your going to run into issues with asymmetrical traffic unless you do host routing on each box that actually sits in any transit network (the network between routers)..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      akuma1x @DINU
                                      last edited by Sep 26, 2019, 5:21 PM

                                      @DINU said in Firewall Rule to Allow RDP from WAN to LAN......Need help:

                                      I need to do triple NAT here.. apart from doing this ... can you suggest some other good options...

                                      i went back and read the entire thread again. Why do you need this part: Asus RT-AX88U Wireless Router?

                                      Jeff

                                      D 1 Reply Last reply Sep 26, 2019, 6:16 PM Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by Sep 26, 2019, 5:56 PM

                                        I doubt he does to be honest... Should just be used as AP to be honest... And now that he has nat turned off good luck getting that modem and asus to actually route and not nat ;)

                                        He should put his modem into bridge mode, and just use pfsense as his edge nat and firewall, and wireless should just be AP... Simplifies the whole mess.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          DINU @akuma1x
                                          last edited by Sep 26, 2019, 6:16 PM

                                          @akuma1x

                                          I want my family to connect their internet directly without PFsense..SO I have connected Asus RT-Ax88U router between Airtel internet moden and Pfsense...

                                          A 1 Reply Last reply Sep 26, 2019, 9:29 PM Reply Quote 0
                                          27 out of 76
                                          • First post
                                            27/76
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received