WAN interface connected to Router instead of Cable Modem - Port Aliases

[kody]

Hello,

I have v2.3.1_p5 configured as shown in the attached gif. The WAN interface is attached to a router, instead of the cable modem. Therefore, the WAN address is a private IP address, and not a public IP address.

Are there any special configurations needed because of this?

Specifically, I'm having difficulty getting F/W rules using Port Aliases working.

Thanks.

[jahonix]

At  Interfaces | WAN you need to uncheck "Block private networks".

[kody]

Thank you jahonix.

[phil.davis]

There's nothing special to do for outgoing traffic from LAN - it should double NAT (in pfSense then in the front-end router.
Of course, if you want to receive any incoming connections from the public internet then you are going to have to port-forward (on the router) the ports you want to offer services on (or all ports) from the router public WAN through to pfSense WAN.

[kody]

Thanks phil.davis. I think I have something wrong in my port alias config because everything works well until I enable the F/W rule with the alias. I'll read the post on aliases again and see what I'm missing.

Thanks.

[johnpoz]

"until I enable the F/W rule with the alias. "

And what rule are you creating with an alias?

[kody]

The "allow outbound ports but block everything else rule" (actually two rules - one to allow ports in the alias, and one to block everything else) from "Taming the Beasts" at https://forum.pfsense.org/index.php?topic=78062.0

After following the steps in the post, no traffic gets through (until I delete/disable the newly created rules).

Since that post was written in 2014, I'm pretty sure the GUI has changed since then. Which would explain my confusion while working through the process in that post. I had to try and complete the steps from the [old] procedure for the older GUI in the post , in the new 2.3.1-Release-p5 (i386) GUI.

[kody]

I think I resolved this and accomplished pretty much what I wanted to do in v2.3.1 by:

• Create port alias with LAN ports I want to allow outgoing traffic on the "Firewall/Aliases/Ports tab.

• On the Firewall/Rules/LAN tab, edit the "Default allow LAN to any rule".

• Change Protocol from "Any" to "TCP".

• Under "Destination" select "other" in the "Destination port range" "From" and "To" DDLBs.

• Type the name of the port alias in the "Custom" "From" and "To" Text boxes.

• Click "Save".

• Click "Apply Changes".