Port scan from outside indicates some port are open.

[m3tatr0n]

Hi All,

I have a few 1:1 NATed servers that have some ports that are open from outside our LAN that I did not open.
As I understood in pfsense all ports are blocked unless specifically allowed access to from outside the LAN.

thanks

[johnpoz]

Well if you did a 1:1 Nat normally open the all the ports to that box.

Out of the box all unsolicited traffic to your pfsense wan IP would be dropped yes.

Why don't you post up your wan rules, and then the findings of your port scan from outside.

[kpa]

Check you firewall rules. If you have NAT or 1:1 NAT rules created there will associated firewall rules to let the traffic trough. This shouldn't be too surprising since a port forward (RDR) or a 1:1 NAT is useless without a matching firewall rule to allow the traffic in.

[m3tatr0n]

Thanks Johnpoz,

Here is the screen shot of of the wan rule for one specific server:
Protocol     Source  Port     Destination Port       Gateway
IPV4 TCP      *                *            192.168.2.11      web-ports      *

web-ports is an alias for port 80 and 443
192.168.2.11 is the internal server
and there is a 1:1 NAT rule for that inernal ip address.

Here is the nmap port scan result:
PORT      STATE SERVICE
80/tcp    open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
1801/tcp  open  msmq
2103/tcp  open  zephyr-clt
2105/tcp  open  eklogin
2107/tcp  open  msmq-mgmt
3071/tcp  open  csd-mgmt-port
4899/tcp  open  radmin

[johnpoz]

And that was done to your pfsense wan IP from from outside??  Ie internet, and what is in front of pfsense?

That is the only rule you have on your wan?  Do you have any rules in floating?  Your alias has what exactly in it - just 80 and 443 (web ports)

BTW why would you do a 1:1 nat if all you want to go to your 192.168.2.11 box is the web ports?  Why not just do a simple port forward for those ports.

[m3tatr0n]

Yes it was done from the outside.

I have quite a few servers that needed to be publicly accessible. A few webservers.
A few servers that listens to incoming ports from clients sending gps coordiantes.
A couple of mail servers. So all these need to have their own public facing IP addresses.

What I am doing right now is just remvong the 1:1 nat entries and  just do port forwarding.

Thank you

[johnpoz]

Yeah normally you would do 1:1 nat when you want all traffic to go to that box, and then either firewall at the box or just don't listen on the box other than what you want to allow.

Couple of ports would just be port forwards.

But something is missing from the puzzle here, since your firewall rule should block the traffic other than what is going to the 192.168.2.11 box..  Per
https://doc.pfsense.org/index.php/1:1_NAT

To allow traffic in from the Internet, a firewall rule must be added on the associated WAN interface allowing the desired traffic, using the destination IP of the internal private IP.

[m3tatr0n]

For now I'll just disable 1:1 nat and stick with forwarding ports bound for public ip addresses to their respective internal ip addresses.

I would still pursue the 1:1 NAT on a linux server that is not so crucial and has an internal firewall just to satisfy my curiosity.

Thank you for the advice.