Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwarding and dual stack issues

    Scheduled Pinned Locked Moved NAT
    4 Posts 2 Posters 581 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      Ryan0751
      last edited by

      My pfSense Netgate box is on a dual-stack cable modem setup.

      I have Dynamic DNS set up so that my hostname (pfsense.foo.com) has both valid and correct A and AAAA records for the IPv4 and IPv6 WAN IP's.

      I have an IPv4 port forwarding rule that directs traffic on high port to an internal IPv4 SSH server (running on the standard port 22).

      The issue is that if I try to ssh to the WAN IP on my pfSense box to get into my SSH server, and my remote client supports IPv6, of course the SSH client is trying to connect to the IPv6 WAN IP on my port forwarding high port.

      The connection just sits there until the clients stack falls back to IPv4, and then things work wonderfully.  But it takes quite a long time (30s - 1m).

      I COULD alter my hostnames to have separate IPv4 and IPv6 hostnames, but this seems a bit silly.  Is there a better way to fix this?

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        Just create separate rules for IPv4 only and IPv6 only.  The IPv4 rule port forwards and IPv6 allows.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • R
          Ryan0751
          last edited by

          Destinations aren't the same.

          In the port forward case my WAN IPv4 address forwards to an internal IP, in the IPv6 case I don't want to "allow" SSH to the WAN IP.

          1 Reply Last reply Reply Quote 0
          • R
            Ryan0751
            last edited by

            I think the easiest solution is to just force IPv4 with the client (ssh -4).  This avoids the long delay.

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.