Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall Rule to Allow RDP from WAN to LAN......Need help

    Scheduled Pinned Locked Moved Firewalling
    76 Posts 7 Posters 10.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      I doubt he does to be honest... Should just be used as AP to be honest... And now that he has nat turned off good luck getting that modem and asus to actually route and not nat ;)

      He should put his modem into bridge mode, and just use pfsense as his edge nat and firewall, and wireless should just be AP... Simplifies the whole mess.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • D
        DINU @akuma1x
        last edited by

        @akuma1x

        I want my family to connect their internet directly without PFsense..SO I have connected Asus RT-Ax88U router between Airtel internet moden and Pfsense...

        A 1 Reply Last reply Reply Quote 0
        • A
          akuma1x @DINU
          last edited by akuma1x

          @DINU said in Firewall Rule to Allow RDP from WAN to LAN......Need help:

          I want my family to connect their internet directly without PFsense..SO I have connected Asus RT-Ax88U router between Airtel internet moden and Pfsense...

          I'm assuming wirelessly, like for mobile devices and stuff? Or wired into the Asus? Is this so they aren't filtered or less confusing for them, or what?

          You should, like @johnpoz says above, change it up a little bit.

          Airtel Internet Modem (in bridge mode) -> pfsense -> LAN -> Asus RT-AX88U (VLAN'd for only your family to use)

          That would make NAT-ing and VPN-ing (like you say you want to do) and etc. into or out of your network so much easier, promise.

          Jeff

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            As you have explained it, its a complete and utter mess..

            Isolating traffic is very simple, keeping your family away from your network is very simple and does not require such an nonsense network. Pfsense, vlan switch and AP that does vlans.. Can be done with dumb switches and and dumb AP as well - just a bit more complicated and and extra hardware depending..

            But what you have drawn out is just a mess.. and complete and utter nightmare to try and actually manage.

            If you explain what you want, we can show you how to do it correctly, easy and with a min budget..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • D
              DINU
              last edited by

              I have below components

              1. Airtel Internet Modem
              2. TP-Link T2500G-10MPS 8-Port Gigabit L2 Managed
              3. Desktop Tower Server which have my LAN VMs on it.(with Two Physical NIC's)
              4. Asus RT-AX88U Wireless Router
              5. Laser Printer

              I have installed pfsense on my tower server as VM.

              I need the following :

              1. I want my family to connect internet through wifi without any disturbance even I reboot pfsense they should not get affected.
              1. I want to access my LAB through wifi from internal network.
              2. I want to access my LAB machines through internet(ie) from remote site as well.
              3. I want to connect my printer through pfsense LAN network.

              Kindly provide me the network design to achieve above..

              Thanks in Advance,
              Dinu

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                So bridge your modem, connect it to your VM Pfsense on wan.. Then put your networks behind, connected via your smart switch.. Do whatever vlans you want, put 3rd party firmware on your asus so you can do vlans = done!

                If your soho wifi router can not run 3rd party firmware that actually supports vlans, then get a real AP.

                You can connect your other vms to whatever vlans you want on your host.

                Do you need a drawing?

                I ran such a network for many years before I put my pfsense on actual hardware.. An I still run some VMs on different vlans. Its really basic 101 networking.. Running pfsense is not all that different than running on hardware, only difference is your running some virtual switches vs just hardware one.. Be happy to put together an example drawing if that is what you want with a few vlans, etc.

                What you run as your hypervisor means nothing other than some details on how you setup up the vswitches and do some vlans on your VM Host.

                Once you have a vlan capable switch, and AP that does vlans - how you segment your network is very simple. The whole thing with having the correct hardware that allows you to do what you want. A vlan capable switch and AP is key - then segmentation becomes simple configuration. The whole point behind vlans ;)

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • D
                  DINU
                  last edited by

                  Can you pls put me drawing and send it to me ? It will be really helpful....

                  my switch have Vlan capable....

                  So bridge your modem, connect it to your VM Pfsense on wan.. Then put your networks behind, connected via your smart switch.. Do whatever vlans you want, put 3rd party firmware on your asus so you can do vlans = done!

                  As per above, wifi asus router will come behind firewall and if i reboot my pfsense then it will affect the internet which is being use by my family (TV, Mobile, Laptop, etc..) I dont want that to happen...

                  FYI : I have Windows 2012 R2 on my host with VMware work station installed. pfsense is on VMware workstation... already I have different Vswitch from Vmware workstation for my LAN, DMZ, freeSAN etc..

                  1 Reply Last reply Reply Quote 0
                  • D
                    DINU
                    last edited by

                    Any Update pls ??

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      @DINU said in Firewall Rule to Allow RDP from WAN to LAN......Need help:

                      if i reboot my pfsense

                      Why and the F would you do that.. The only time you need to reboot pfsense would be to upgrade its version.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • D
                        DINU
                        last edited by

                        I said I don't my family to use PFsense firewall... They have to access the internet without any disturbance...

                        Do you have any recommended diagram ?

                        If not I will prepare on my own....

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Do it how you were doing then, but your going to need pfsense to be natting and port forwarding, you your going to have a mess and stuff behind pfsense not going to be able to get to the internet, cuz your native firmware is not going to nat downstream networks, or more likely even know how to route to them, etc.

                          So what I would do is just turn nat back on in pfsense and if you need to get to stuff behind pfsense from network upstream, then do a simple port forward.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • D
                            DINU
                            last edited by

                            I have changed my connection now....as below

                            ISP Modem--->pfSense(VM)---> LAN--->Asus Wifi router

                            LAN have Windows 2012 R2 DHCP Server(Scope : 192.168.30.X) with domain configured.All my Windows clients in LAN will get IP from Windows DHCP server. I can able to access internet from my Windows client.

                            I have configured Asus Wifi router in Wireless router mode, my router IP is 192.168.50.1 and DHCP Enabled : 192.168.50.2 to 192.168.50.100, so my WIFI users will get IP from routers.
                            In router in WAN status I can see : Internet status: Disconnected.

                            Unable to access the internet through wifi, when I try to ping google.com getting request time out. but when I try to do tracert 8.8.8.8 I can able to reach the IP.

                            Looks like DNS issue, let me know what could be the issue.

                            Thanks,
                            Dinu

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Thought you said you didn't want to put pfsense in front.. If your going to put pfsense in front, then you wouldn't be freaking natting at your asus.. But you wouldn't be routing either, you would use it as just an AP.. If your going to use it as downstream router, then you have to add a gateway in pfsense to know how to get to that downstream network.. And then you still run into the problem of hosts on your transit network..

                              Use your wifi router as just an AP, put on a different vlan if want..

                              If you want to use your wifi router as downstream nat router, yeah its wan would need to be able to talk to pfsense to get to the internet.. What is it using for dns, your saying devices behind your asus can tracert to 8.8.8.8.. Where do the clients point for dns, most likely your asus.. Where does it point for dns?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              D 1 Reply Last reply Reply Quote 0
                              • D
                                DINU @johnpoz
                                last edited by

                                @johnpoz :

                                I want to use my asus wifi router as downstream NAT router... I have DHCP enabled with DNS pointing to 8.8.8.8 and 8.8.4.4.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  As a nat router there is nothing to do.. It would get its wan IP from pfsense lan.. And use whatever dns you hand it via dhcp.

                                  It would then for its clients hand out some other IP range, pointing to itself for gateway and to itself for dns..

                                  When a client asks for dns, the router would ask pfsense for dns, etc.

                                  If you want your clients or router to use 8.8.8.8 for dns then set that, and make sure its allowed.. Your not trying to redirect or block other dns at pfsense or your asus router? If your asus router is saying it not connected to internet.. Then yeah you have some sort of problem - does its wan get an IP from pfsense dhcp server?

                                  You understand your in the same boat now, if you reboot pfsense, or the host pfsense is running on as a vm, yoru downstream router has no internet.. So if your going to go that route, then why not just use your asus as AP and as a vlan off pfsense directly?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    DINU
                                    last edited by

                                    It would then for its clients hand out some other IP range, pointing to itself for gateway and to itself for dns..
                                    I have configured DHCP as below in my Asus router :
                                    DHCP : 192.168.50.2 to 192.168.50.100
                                    Gateway 192.168.50.1
                                    DNS : 8.8.8.8, 8.8.4.4

                                    When a client asks for dns, the router would ask pfsense for dns, etc.
                                    I have configured primary 8.8.8.8 and seconday 8.8.4.4 in pfsense DNS

                                    Your not trying to redirect or block other dns at pfsense or your asus router? If your asus router is saying it not connected to internet.. Then yeah you have some sort of problem
                                    I am not blocking any DNS at pfsense or asus router

                                    does its wan get an IP from pfsense dhcp server?
                                    Asus router is not getting WAN IP from Windows DHCP server... Note : I have not used pfsense DHCP...instead of it I have Windows DHCP server.

                                    So if your going to go that route, then why not just use your asus as AP and as a vlan off pfsense directly?
                                    I have tried with AP as well I have same issue, unable to access internet but able to tracert 8.8.8.8...... Thats what I have surprise now... even in AP mode I am unable to access the internet.

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Are you allowing udp? What are you firewall rules on your lan? And your saying your other clients can access, just not your wifi?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        DINU
                                        last edited by

                                        pfsense_firewall1.jpg

                                        And your saying your other clients can access, just not your wifi?
                                        Yes my other clients(ie) Windows machine sitting in LAN able to access internet..but not wifi clients...

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          So when your AP mode your clients get an IP from dhcp from yoru lan network, your windows dhcp server? They point to pfsense for gateway?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          D 1 Reply Last reply Reply Quote 0
                                          • D
                                            DINU @johnpoz
                                            last edited by

                                            @johnpoz said in Firewall Rule to Allow RDP from WAN to LAN......Need help:

                                            They point to pfsense for gateway?

                                            Yes correct...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.