just switched to pfsense - port forward not working
-
Hi I just switched from using a TP-Link ARcher C5400 router, to using pfsense.
I have multiple computers and virtual computers on my network and i have one setup to be my ebook server, and it is listening on port 7777. before i switched to pfsense, i could remotely access my ebooks application over port 7777 by putting my public facing ip address , say 75.120.55.205, and the port number, like http://75.120.55.205:7777
that worked fine on my tp-link router when i have the 7777 port forwarded to the IP address of the computer running the ebook software. However, i setup the same port forwarding rule pfsense, and i am unable to access the ebooks. Its weird, i CAN access them remotely, from outside my network, but i can no longer access the ebook server when i am on my network on one of the computers on the local network. Previously i could access the ebook server the same way internally as i do external to the network.
Pfsense has so much finer granularity of control than a retail /home use router, that i'm sure i have not set something that needs to be set somewhere. Anyone have thoughts on what i need to set to be able to access the ebook server when i am at home , on the local lan?I'm sure the comments i'll get are just use the lan ip address - and that DOES work - but i have this setup for some very non-technical users in my family to be able to access so they don't have to use an IP address. (i use the NoIP service and a dynamic dns service to forward any incoming http traffic from the domain name (like myebooks.org) to port 7777 on my router.
Plus, i am OCD and i just cannot leave alone something that worked before and now doesn't even though there may be a work-around (using IP address in my browser address) -
Edit the port forwarding rule and set the NAT reflection option to "Enable (NAT + proxy)".
-
Nat reflection is not the way to go.. If the box is local why would you just access it with its local IP, or better yet its fqdn.. There is almost zero reason to ever have to nat reflect - other than working around some stupid hard coded IP.. Which should be fixed vs working around.
Lets say you use host.domain.tld to resolve to whatever your public IP is.. Well just resolving that locally to whatever the local IP is 192.168.1.100 or whatever.
-
NAT reflection is the solution the TO was looking for.
I use it as well, and there are pretty good reasons for that. -
Sorry don't buy it - if your using nat reflection, your doing it wrong..
-
-
is there some security risk with NAT reflection or is it just not the preferred way to handle?
-
No security risk, only technically it's ... ugly.
The preferred way would be to create a host override in your local DNS server for the URL you use externally (yours.noip.org) and point it to your server IP.
-
I couldn't figure out how to do that. i tried the host override and couldn't get it to work. i ended up installing squid and doing a reverse proxy instead. it was pretty straight forward to setup that way and the squid install is minimal.
I don't know if revers proxies are any kind of a security issue - but at the company i work for, they just quit allowing them on our company network. were a financial services company and overly cautious about everything. -
Did you clear the DNS cache of the requesting machine, otherwise it uses its own cache until TTL expires.
