Need clarification on setup of NAT and Firewall rule

[oldunixguy]

I am using 2.4.0-BETA (arm) built on Sat Jun 10 11:37:40 CDT 2017.

I am NATing wan tcp port 4443 to LAN IP 443 so the port numbers are different.

I read here https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense that when setting up the NAT it automatically creates the FW rule.

I see the auto generated FW rules.

It doesnt seem to be working on the FW. So here is the question:

What port in the FW rule should be used in my case? The WAN inbound port 4443 or the NATed LAN outbound port 443?

It seems to me it should be 4443. But what I see on the FW is the port 443.

I have a second question….

When I see the list of FW rules why are some "dimmed" but otherwise appear enabled?

thanks for the info.
oldunixguy

[johnpoz]

"When I see the list of FW rules why are some "dimmed" but otherwise appear enabled?"

Your going to have to post pic of what your talking about..

If your having issues with port forwarding.
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

[Derelict]

If a rule is "dimmed" it is disabled.

[oldunixguy]

I have not manually created, enabled or disabled any of the FW rules. So these are a result of the "automatic" features supposedly from me creating the NAT entries.

you can see the NAT for the inbound 44443. but there is no corresponding FW rule for 44443.

something disabled the 10.2 443 FW rule. I did not.
no fw rule was set up automatically for 44443

the automatic FW rule for 10.2 ports 20001-20004 is disabled. again, I did not disable it.

Any ideas on why these rules get auto disabled?

So, I'm confused when the documentation says the FW rules are setup automatically for the NAT entries I create.

Also, I'm still looking for clarification of whether the NATed inbound port on wan is to be enabled in the FW or the outbound destination port of the NAT… Which is it supposed to be?

It appears from looking at the FW rules automatically that the outbound port is supposed to be used. But this doesnt sound right to me. Shouldnt the wan inbound port be the one that has to be enabled in the FW?

Maybe asking this differently might be useful. Which is "processed" first, the FW rule or the NAT rewrite?

If the NAT is done first then I can understand the FW rule has to be created for the outbound NAT destination IP and port. But this sounds odd in that shouldnt the FW rule be executed BEFORE NAT?

I'm not used to the representation on these entries when they are dimmed. Some of the symbology seems opposite to me...

thanks for the help. I will go check the link posted by johnpoz.
oldunixguy


[kpa]

NAT is always applied first regardless of the direction. On incoming port forwards this means that the destination addresses used in the associated firewall rules must be the addresses after the address rewrite. On outbound NAT (for example on the WAN) again the same deal, the source addresses are rewritten before the firewall rules are applied.

[Derelict]

Neither of those have anything to do with outbound NAT.

In a simplified nutshell:

Port forwards translate destination addresses/ports when a connection arrives into an interface.

Outbound NAT translates source addresses/ports when a connection leaves an interface.

Firewall rules for port forwards are checked after NAT occurs. So the destination must be the translated address/port.

Outbound connections are generally just allowed by default since the connection has already been passed by the source interface rules (such as on LAN).

[oldunixguy]

very fine. that clears that up.

now why are the automatic FW rules based on the NAT entries not "enabled" or stated differently what is disabling them when they are supposed to be created and enabled automatically when one creates the NAT entries?

thanks
oldunixguy

[Derelict]

I have no idea what you have done there. Post both the complete config pages for a grayed-out port forward and the corresponding rule page. One pair should be enough.