NAT Duplication?

[mlimo]

I have a ProxyARP range of addresses attached to my WAN service.

I have designated this as the IP address for a terminal server.

I have created a 1:1 rule - so the Terminal server presents this IP if i go to whatsmyip.org etc

I am making a port forwarding NAT rule for RDP as follows

Incoming port 33390 -> Internal IP address, port 3389.
My problem is, now both ports are answering
I can connect to the terminal server on 33390 and 3389
See attached graphics for the NAT Rule and WAN firewall Rule

What am i missing, this type of rule used to work with 2.2 series.

I have tried the rule without the associated firewall rule, and it wouldnt connect.

[cmb]

Where you have a 1:1 NAT and a port forward like that, the rule that allows traffic through the port forward will also allow traffic through the 1:1 NAT. That's how it's always worked, just the nature of how pf functions since the translation applies first for WAN rules.

If you specify the "pass" option in the port forward, so there is no associated firewall rule, that should keep it restricted to only the high port you're port forwarding through.

[mlimo]

Hi CMB,

Thanks for the reply.

I have already tried the NAT without the rule, with no success.
Perhaps something with the ProxyARP IP address.

It does seem to work OK directly on the WAN ip address