Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    NAT Port forward wrong source address

    NAT
    3
    29
    1568
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      seerofvoid last edited by

      I have a a few services I'm running, and for proper operation they must communicate via my public IP (71.90.XXX.44).
      Service A listens on port 9115 for Service B to connect from public IP.

      I have forwarded the correct port (9115), but when I look in the logs, Service A sees Service B connecting from the firewall's LAN address (172.16.0.1). I have confirmed this with Wireshark as well.
      What I need is for Service A to see anything that gets forwarded as coming from the public IP, not the LAN address of the firewall. I've tried Outbound NAT, but can't get it to work.

      1 Reply Last reply Reply Quote 0
      • Derelict
        Derelict LAYER 8 Netgate last edited by

        Post what you have done, not a description of what you think you have done.

        Chattanooga, Tennessee, USA
        The pfSense Book is free of charge!
        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • S
          seerofvoid last edited by

          I've attached the relevant firewall NAT rule, and my attempt at outbound NAT.
          Is there anything else you need to see?




          1 Reply Last reply Reply Quote 0
          • Derelict
            Derelict LAYER 8 Netgate last edited by

            That rule does nothing.

            It says that any connection going out WAN sourced from 172.16.21.1 to any address with a destination port of 9115 should have its source address translated to the WAN interface address.

            That is exactly what the default, automatic NAT would do.

            What, exactly, are you trying to accomplish?

            Chattanooga, Tennessee, USA
            The pfSense Book is free of charge!
            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • S
              seerofvoid last edited by

              I'm trying to make any connection from WAN to port 9115 keep the source address of 71.90.XXX.44 (WAN), sorry if I wasn't very clear.

              1 Reply Last reply Reply Quote 0
              • Derelict
                Derelict LAYER 8 Netgate last edited by

                What do you mean "any connection from WAN" ???

                If you want to forward connections from THE INTERNET into the WAN interface on port tcp/9115 to an inside server you want a port forward, not outbound NAT.

                https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

                https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                Chattanooga, Tennessee, USA
                The pfSense Book is free of charge!
                DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • S
                  seerofvoid last edited by

                  I do have the port forward, and that works correctly. The issue is the server does not see the packet as coming from WAN, it sees it as coming from pfSense, and the service running on the server won't work with that.
                  Here is the exact scenario:
                  Service B sends packet to WAN IP:9115
                  Service A gets packet from pfSense IP.

                  Yes, it would be worlds easier if it could do this internally, but the services don't allow this.

                  EDIT: This thread here has the opposite solution, rewriting the source IP to the firewalls IP. I'm looking to do the opposite.
                  https://forum.pfsense.org/index.php?topic=45771.0

                  1 Reply Last reply Reply Quote 0
                  • Derelict
                    Derelict LAYER 8 Netgate last edited by

                    The default is the opposite.

                    You have to do nothing special to make the real, inside host that is receiving the forwarded connection see the traffic as sourced from the original source address.

                    That is the default.

                    Instead of using nebulous terms you might need to post a packet capture or more details about exactly what it is you think you are seeing.

                    I suppose it is possible some other device is performing some kind of NAT that hasn't been disclosed yet.

                    Need details of what is happening to the packets at each hop.

                    Chattanooga, Tennessee, USA
                    The pfSense Book is free of charge!
                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      seerofvoid last edited by

                      That's what I figured, but the pcap shows differently. It is attached below. The port of interest is 9115.

                      The network setup is as follows:

                      BroadbandModem –> pfSense WAN (71.90.xxx.44) --> LAN (172.16.0.1/16) --> Server (172.16.21.1)

                      nat.pcapng

                      1 Reply Last reply Reply Quote 0
                      • Derelict
                        Derelict LAYER 8 Netgate last edited by

                        Post the rest of your outbound NAT rules.

                        Is the port forward the only thing you have in play? No HA proxy or anything?

                        Are you actually testing from the outside or are you testing via NAT reflection from the inside (which will look just like that)??

                        I say again:
                        https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                        Chattanooga, Tennessee, USA
                        The pfSense Book is free of charge!
                        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • S
                          seerofvoid last edited by

                          Attached is the full list of outbounds. If I run an online open port test I do see the source IP from the website, but the nature of the service I'm running requires the packet come back to the same server with my WAN IP.
                          I don't have any HA proxy or anything. What I'm trying to get around is the NAT reflection, so the source IP is correct for this application.
                          When I turn off NAT reflection for the NAT forwarding rule, no packets get delivered.


                          1 Reply Last reply Reply Quote 0
                          • Derelict
                            Derelict LAYER 8 Netgate last edited by

                            How about you provide the following:

                            I am making a connection from a host with IP address W.W.W.W/W

                            The default gateway on host W.W.W.W is X.X.X.X

                            That host is connecting making a connection to Y.Y.Y.Y port Y

                            That traffic needs to be forwarded to Z.Z.Z.Z port Z

                            The source address of the traffic when it arrives at Z.Z.Z.Z needs to be Q.Q.Q.Q

                            Chattanooga, Tennessee, USA
                            The pfSense Book is free of charge!
                            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • S
                              seerofvoid last edited by

                              I am making a connection from a host with IP address 172.16.21.1/(random source port)

                              The default gateway on host 172.16.21.1 is 172.16.0.1

                              That host is connecting making a connection to 71.90.208.44 port 9115

                              That traffic needs to be forwarded to 172.16.21.1 port 9115

                              The source address of the traffic when it arrives at 172.16.21.1 needs to be 71.90.208.44

                              1 Reply Last reply Reply Quote 0
                              • Derelict
                                Derelict LAYER 8 Netgate last edited by

                                You are trying to port forward back to yourself?

                                I do not think what you are attempting to do is possible.

                                You are already translating both source and destination addresses once using NAT reflection.

                                If anything you would want an outbound NAT rule on LAN for matching traffic that sets the source address to 71.90.208.44 but that address is not present on that interface so I do not think you can do that.

                                Maybe switching to NAT+Proxy would help but the same limitation would apply on LAN.

                                Your use case is pretty far out there.

                                Chattanooga, Tennessee, USA
                                The pfSense Book is free of charge!
                                DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • johnpoz
                                  johnpoz LAYER 8 Global Moderator last edited by

                                  Yeah not getting this at all.. You want to loop back to your OWN device?  And you want it to look like you came from the pfsense WAN IP?  For what possible reason would you want to do this??

                                  Why would you not just connect to yourself?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                  1 Reply Last reply Reply Quote 0
                                  • Derelict
                                    Derelict LAYER 8 Netgate last edited by

                                    I just had a chuckle looking at the thread title NAT Port forward wrong source address.

                                    "wrong source address"

                                    Chattanooga, Tennessee, USA
                                    The pfSense Book is free of charge!
                                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      seerofvoid last edited by

                                      @johnpoz:

                                      Why would you not just connect to yourself?

                                      Lets say I have Service A, Service B, and Client X.
                                      Both Service A and Service B need to be accessible from (WAN IP) for Client X to connect.
                                      The only way these services can do this is to communicate via (WAN IP), so they can tell Client X they are there.

                                      Yes, this is idiotic. I know. These same services even communicate locally for other operations, but for the client to work, they must run public.@Derelict:

                                      I just had a chuckle looking at the thread title NAT Port forward wrong source address.

                                      "wrong source address"

                                      To the services, it is the wrong source address, and Service A drops the connection from Service B because of this.

                                      1 Reply Last reply Reply Quote 0
                                      • Derelict
                                        Derelict LAYER 8 Netgate last edited by

                                        To any reasonable expectation of traffic flow, it is the correct source address.

                                        Chattanooga, Tennessee, USA
                                        The pfSense Book is free of charge!
                                        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          seerofvoid last edited by

                                          @Derelict:

                                          To any reasonable expectation of traffic flow, it is the correct source address.

                                          You are correct. These services were originally designed to be run without any NAT. I don't have the liberty of doing such a thing.

                                          1 Reply Last reply Reply Quote 0
                                          • Derelict
                                            Derelict LAYER 8 Netgate last edited by

                                            I would try something like this.

                                            I would not expect it to work.

                                            That protocol any in the screen shot should probably be protocol TCP but I don't think that has been specified by you.

                                            ![Browser Shot-2017-08-25-12-33-23.png](/public/imported_attachments/1/Browser Shot-2017-08-25-12-33-23.png)
                                            ![Browser Shot-2017-08-25-12-33-23.png_thumb](/public/imported_attachments/1/Browser Shot-2017-08-25-12-33-23.png_thumb)

                                            Chattanooga, Tennessee, USA
                                            The pfSense Book is free of charge!
                                            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • johnpoz
                                              johnpoz LAYER 8 Global Moderator last edited by

                                              "The only way these services can do this is to communicate via (WAN IP), so they can tell Client X they are there."

                                              What?  Makes no sense..

                                              If your services require to be on a public - then put them on a public IP..  Do not try to run them behind a NAT..

                                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                                              If you get confused: Listen to the Music Play
                                              Please don't Chat/PM me for help, unless mod related
                                              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                              1 Reply Last reply Reply Quote 0
                                              • S
                                                seerofvoid last edited by

                                                @johnpoz:

                                                "The only way these services can do this is to communicate via (WAN IP), so they can tell Client X they are there."

                                                What?  Makes no sense..

                                                If your services require to be on a public - then put them on a public IP..  Do not try to run them behind a NAT..

                                                If I had a 2nd IP to do this with, I would. Unfortunately my ISP makes it prohibitively expensive to add another IP.

                                                @Derelict:

                                                I would try something like this.

                                                I would not expect it to work.

                                                That protocol any in the screen shot should probably be protocol TCP but I don't think that has been specified by you.

                                                As you expected, it does not work.

                                                1 Reply Last reply Reply Quote 0
                                                • Derelict
                                                  Derelict LAYER 8 Netgate last edited by

                                                  If I had a 2nd IP to do this with, I would. Unfortunately my ISP makes it prohibitively expensive to add another IP.

                                                  Sounds like you've got yourself painted into a corner there.

                                                  Chattanooga, Tennessee, USA
                                                  The pfSense Book is free of charge!
                                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                  1 Reply Last reply Reply Quote 0
                                                  • johnpoz
                                                    johnpoz LAYER 8 Global Moderator last edited by

                                                    "I would. Unfortunately my ISP makes it prohibitively expensive to add another IP."

                                                    Get a different ISP… Move DC/Colo - put your VPS on a different cloud.. Run it on IPv6 ;)  There are bajillion options here vs trying to do something that is not meant to work in the first place.

                                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                    If you get confused: Listen to the Music Play
                                                    Please don't Chat/PM me for help, unless mod related
                                                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                    1 Reply Last reply Reply Quote 0
                                                    • johnpoz
                                                      johnpoz LAYER 8 Global Moderator last edited by

                                                      Yeah you really should look to getting your /28 routed to you vs doing 1:1 Natting and such.. When a ISP just gives you a block like that its really meant that all your devices will just be on that network vs behind another router.. If you want to run your router/firewall then you should ask for that /28 to be routed to you via a transit.. This could be a /29 as Derelict mentions or even a /30, etc.

                                                      Once this /28 is routed to you then you can do whatever.. Break it up in to 2 /29 if you want.. Etc..  Cost you some IPs that way - but would allow you to assign a /29 to a specific customer.. behind pfsense.

                                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                      If you get confused: Listen to the Music Play
                                                      Please don't Chat/PM me for help, unless mod related
                                                      2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                      1 Reply Last reply Reply Quote 0
                                                      • S
                                                        seerofvoid last edited by

                                                        @johnpoz:

                                                        Yeah you really should look to getting your /28 routed to you vs doing 1:1 Natting and such.. When a ISP just gives you a block like that its really meant that all your devices will just be on that network vs behind another router.. If you want to run your router/firewall then you should ask for that /28 to be routed to you via a transit.. This could be a /29 as Derelict mentions or even a /30, etc.

                                                        Once this /28 is routed to you then you can do whatever.. Break it up in to 2 /29 if you want.. Etc..  Cost you some IPs that way - but would allow you to assign a /29 to a specific customer.. behind pfsense.

                                                        I'll have to look in to a business line again then, because that's the only way Charter will give statics.

                                                        1 Reply Last reply Reply Quote 0
                                                        • Derelict
                                                          Derelict LAYER 8 Netgate last edited by

                                                          This could be a /29 as Derelict mentions or even a /30, etc.

                                                          I always recommend people ask for a /29 because:

                                                          1. It is ezpz to justify. Just tell them you need to do VRRP/CARP/HA.
                                                          2. Moar addresses is moar better.

                                                          Chattanooga, Tennessee, USA
                                                          The pfSense Book is free of charge!
                                                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                          1 Reply Last reply Reply Quote 0
                                                          • johnpoz
                                                            johnpoz LAYER 8 Global Moderator last edited by

                                                            Did threads get merged?  Something is not right.. There was a thread about the nat, and then there was a thread about /28

                                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                            If you get confused: Listen to the Music Play
                                                            Please don't Chat/PM me for help, unless mod related
                                                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                            1 Reply Last reply Reply Quote 0
                                                            • S
                                                              seerofvoid last edited by

                                                              Thankfully I've found a solution specific to this set of services. Thanks for the help! I'm locking this now.

                                                              1 Reply Last reply Reply Quote 0
                                                              • First post
                                                                Last post