Firewall Port Option Not Working

her0wh1m

Hello,

I have a server at a static ip (192.168.2.99). I only wish to tunnel a specific port on this server through the VPN, everything else over WAN.

If I create a rule and select the ip (192.168.2.99) through the VPN the rule works. However, when I select a source port it is not tunneling the source port to the VPN. i.e. I can tunnel by ip but I cannot tunnel by ip AND port.

I cant understand why the rule works without a port but when a port is specified instead of tunneling that port it ignores the rule.

I feel like I'm missing something really obvious here . . . any assistance appreciated.

viragomann

Do you really know the source port?? Or do you mean the destination port?
There are just a few applications which use static source ports, others use dynamic.

her0wh1m

Thanks for your response. The port is the port of my torrent client and is static

So, in my mind what I want is when my torrent client (i.e. port and ip) is detected it is tunneled through the VPN. It works for ip only but not when the port of the client is specified.

viragomann

Torrent uses two ports by default, one for transmission and on for the trackers.
Maybe you're missing the second one.

her0wh1m

Thanks for the response. I'm using rtorrent, it communicates on a single port. DHT etc is not enabled on my client so I dont need the associated additional ports.

Im really stuck on this. I have found some guides for achieving what I want but they simply dont work, the port is ignored when specified.

If I have set-up a config that works at tunneling the required machines ip through the VPN. In the same interface / config, adding the port breaks things. What I am trying to say is either;

pfsense is broken;
The tunneling of ports follows a different concept / strategy to that of IP's and I dont understand this (although why put the port option on the webui if this is the case?)

Grimson

I haven't used a torrent client for some time. But the port you set in these clients is usually only used for incoming connections, outgoing connections will still use a random source port.

johnpoz

^exactly the ports on torrents source is not what you set for the incoming… If your logging default deny and when you put a source port in you would see what is being blocked..

Oh see your trying to policy route... So it works when you set any as source.. So what is the problem? Just sniff the traffic yourself so you can see that the source port is random..

Your best bet here since torrents could be any random dest port, etc. If you do not want all traffic for this client going out your vpn to would be to policy route the other specific traffic you want to go out your normal wan for this client.

her0wh1m

Thank-you. Agreed, from further investigating that the outgoing port is random. I got confused as I used to have a set-up that tunneled based on UID, i.e. it was the process UID that responsible for the routing policy, whereas here I'm dealing with IP & Port.

Yes, I had previously considered routing the traffic I want to go via the WAN instead - I have now implemented this. What I want is for my webserver (port 80) to be accessible via the WAN, obviously it doesnt work if its tunneled through the VPN.

I have set this up, including moving the dynamic dns from my server to the pfsense machine (i.e. as the ddclient was on the server it was returning the VPN IP). The pfsense dynamic DNS provider is updating the ip address to the WAN address, so all OK. However, when I try to access the webserver via my URL I now get webserver errors, 403 forbidden. If I use the WAN IP rather than the URL the webserver works as expected.

her0wh1m

OK, thanks for the suggestions on this. All up and running now, needed to change a few settings at my DNS provider but all good now.

The only thing remaining is minor. When I input my domain name into a computer on the LAN - the pfsense page is loaded, rather than my webserver, along with an error message on DNS rebinding.

If I access my domain name from outside the LAN (i.e. on mobile phone) it all works OK. Does anyone have a hint, as to how do I make my webserver load when requested by the domain name over the LAN.

johnpoz

host override to point, ie split dns.

her0wh1m

Perfect, all sorted. Many thanks.