Access problem

Davvv

Hi team,

I don't know if i'm in the right section (if not don't hesitate to move the post :) )

I'm facing a problem with a pfsense (version 2.3.2-RELEASE (amd64) )

I have a server W2012 R2 behind the firewall i can access the server and the application on it by using the WAN address and the port.
When i make those tests in the LAN, it works as well with LAN IP address and 127.0.0.1 address.

The problem is :
I would like to access the application by using the WAN address when i'm in the LAN. I hope it's clear.

For example :

From the WAN :
telnet 195.X.X.X 9006 : OK

From the LAN :
telnet 195.X.X.X 9006 : KO
telnet 127.0.0.1 9006 : OK
telnet IP_LAN 9006 : OK

Any idea ?

I don't find anything that could block the traffic on the firewall logs.

I trying to find a solution from few days but i don't find any clue.

Thanks for your dear help.

David

viragomann

Look at this thread: https://forum.pfsense.org/index.php?topic=118473.msg655771#msg655771

If you want to access the server by its FQDN, the recommended way is to use split DNS, if you need to access it with its external IP use NAT reflection.

johnpoz

"I would like to access the application by using the WAN address when i'm in the LAN. I hope it's clear."

Why?? As mentioned virogomann that is a nat reflection.. But for what reason would you need/want to do this.

Davvv

Hi,

Thanks for the answers.
We need to make some tests with the application, my colleague need this possibility.
I will look after Nat reflection so :)

Thanks for your help.

Regards,

johnpoz

So your application has hard coded IPs?? That is a really bad idea!!! If it uses a fqdn to resolve, then just setup host override so your fqdn your using resolves to the actual rfc1918 address the application is being hosted on.

But this would not be a good validation test of your application from public internet. The only valid test of that would be from the public internet. This will for one validate your forward is working and can be accessed from public. This should also have some higher latency involved in the connection vs lan speed latency <1ms which your nat reflection would not actually test. Nor would the nat reflection test be valid because maybe something this client or the server itself actually being on the same network might somehow being accessing a resource that someone from the public net would not be able to access.

If you need to test your application that is meant to be used by people outside your network, is to actually test it from outside your network.

Davvv

Understood your explanations. :)

I need to get informations with my colleague.

With this parameter "Nat reflection", now it works from outside and inside as well with the fqdn.

Thanks a lot for your help.

David