• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

1: NAT done but SSH not accessible

Scheduled Pinned Locked Moved General pfSense Questions
21 Posts 3 Posters 2.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by Aug 3, 2018, 11:11 AM

    So this is a VIP? You sure tis working? Why do you have source limited to single IP? Is that the ONLY place your going to be doing ssh from?

    If these are rfc1918 address why are you hiding them? Why do your screenshots look like graph paper? with the grid on them?

    Lets go over this yet again. Is the traffic even hitting your wan? Do a simple sniff.. Does the traffic get there, does it go out your lan to your client your trying to forward to?

    Please go through the troubleshooting guide - where is it failing at.. You have verified traffic hits your wan, towards your vip? And that pfsense is NOT sending the traffic out the lan to your dest IP?

    It really takes all of 2 minutes tops to figure out where you have issue in a port forward.

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    S 1 Reply Last reply Aug 3, 2018, 5:34 PM Reply Quote 0
    • N
      NogBadTheBad
      last edited by Aug 3, 2018, 11:15 AM

      Not used multi WAN but is your Destination of ANY correct ?

      Don't you need two NAT statements or an alias with the two WAN addresses as the destination.

      0_1533294746964_1533293933525-wan-firewall-rule-2.png

      Here's how I NAT my g_ipv4_friendly alias to my sftp box via a single WAN interface :-

      0_1533294818169_NAT.jpeg

      0_1533294925547_Untitled 2.jpeg

      S 1 Reply Last reply Aug 3, 2018, 5:56 PM Reply Quote 0
      • S
        Su30MKI @johnpoz
        last edited by Su30MKI Aug 3, 2018, 6:05 PM Aug 3, 2018, 5:34 PM

        @johnpoz Hi John.. Thanks for your effort. yes I am directing FQDN to this VIP address so I can access it globally. Globally the usable WAN VIP is pinging. But the traffic is not NATing to the DMZ server. I will do the sniff and post the results. I really have to fix this.0_1533317680967_global ping.png 0_1533317702744_NAT-Rule-1.png

        1 Reply Last reply Reply Quote 0
        • S
          Su30MKI @NogBadTheBad
          last edited by Aug 3, 2018, 5:56 PM

          @nogbadthebad Hi! Thank you for your reply. I have tried changing the destination to WAN address in the WAN rule and also in the NAT rule. But still no luck. I don't know why I am not able to do this simple NAT. I have done far tough things in pfsense.
          0_1533318151076_WAN Rules.png

          1 Reply Last reply Reply Quote 0
          • N
            NogBadTheBad
            last edited by NogBadTheBad Aug 3, 2018, 6:12 PM Aug 3, 2018, 6:07 PM

            Is that bottom rule where SSH should hit?

            If so why isn't a port set!

            Draw a diagram of your network, to be honest its a nightmare trying to figure out what's what when you chop off the top of the descriptions.

            https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html

            S 1 Reply Last reply Aug 3, 2018, 6:46 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz Aug 3, 2018, 6:11 PM Aug 3, 2018, 6:10 PM

              The dest would NOT be your wan address if your trying to do your 1:1 on your VIP..

              The is really basic stuff here - first things first, is freaking validate the traffic is hitting this vip. That is always step 1 when troubleshooting anything to do with a port forward. Actually validate traffic gets there.. Since pfsense can do nothing if its never seeing the traffic.

              https://www.netgate.com/docs/pfsense/nat/1-1-nat.html

              With a 1 to 1 nat the dest would be the internal IP on the firewall rule..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              S 1 Reply Last reply Aug 3, 2018, 6:48 PM Reply Quote 0
              • N
                NogBadTheBad
                last edited by NogBadTheBad Aug 3, 2018, 6:21 PM Aug 3, 2018, 6:18 PM

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • S
                  Su30MKI @NogBadTheBad
                  last edited by Aug 3, 2018, 6:46 PM

                  @nogbadthebad I thought NAT simply forwards the traffic from a static IP to an internal ip. Because I want multiple services with mutiple ports to be accessible. that's why I chose NAT. Should I specify the ports even in NAT? Opening all the ports i snot right. Let me put it simple. Imagine I have configured a usable static IP as a VIP. I want that VIP to provide me access to an internal server for multiple services. How do you do it. Tell me the process I will follow exactly. I tried mutiple videos and documents but no luck. Yes, the 2nd one is the rule for NAT.

                  1 Reply Last reply Reply Quote 0
                  • S
                    Su30MKI @johnpoz
                    last edited by Aug 3, 2018, 6:48 PM

                    @johnpoz Thank you John.. I do not get the VIP logs in the firewall logs. I don't know why. If I delete the VIP the FQDN doesn't ping. If the VIP is up it pings. I tried installing Sniff package but it doesn't show in the services. I will go through the document more abd will update you.

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz Aug 3, 2018, 6:56 PM Aug 3, 2018, 6:51 PM

                      You don't need a sniff package - its right under diag, package capture..

                      MY gawd this is getting frustrating.. It takes all of 30 seconds to take a sniff and test this..

                      You don't need to setup any firewall rules or anything. Setup your VIP... Send traffic to it on 22, while your doing the packet capture... Do you see this traffic?

                      Once you see this... Then setup the 1:1 nat.. That is all of 30 seconds more..
                      If it does not work, then sniff on your lan side interface with packet capture. Send traffic to vip - do you see the packets going to the private IP?

                      If you do, but no answer then problem is on your server your send it too. If you don't see it sending then you did your 1:1 nat wrong..

                      The firewall rule you need will be to the private IP address in your 1:1 NAT.. Do you really need pictures for this??

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by Aug 3, 2018, 7:14 PM

                        Here I don't really have an IP I can use.. but on my /30 on wan at work I created a /32 vip using the broadcast address..

                        I then pinged it from home connection... While sniffing... See the traffic hitting it from my home 64.53 address..

                        0_1533323370440_vip.png

                        It doesn't answer ping.. It then add firewall rule to allow ping - and bam it pings..

                        0_1533323664464_pingvip.png

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by Aug 3, 2018, 7:39 PM

                          Here so I created 1:1 nat, then firewall rule to allow ssh from my home IP to the dest private IP..

                          I then created ssh connection to this while sniffing on lan side interface... You can see pfsense send on the ssh traffic. But it doesn't get an answer because IP is actually inside IP of another pfsense in NY from where I am at in Chicago.. And its default route to get to public would go out its wan vs coming back this way.

                          This is why you have to sniff and validate if pfsense is sending the data or not - the problem could be on your host box.

                          0_1533325203484_nat11.png

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • S
                            Su30MKI
                            last edited by Aug 6, 2018, 10:35 AM

                            You are probably right. I tried a sniff on WAN VIP through WAN interface. But there is no request for the VIP. I am sorry for the delay as I was not working on my weekend. I will try configuring the rules and try again

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Aug 6, 2018, 10:38 AM

                              If you would of followed the troubleshoot guide from 4 days ago I linked too... Just saying..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • S
                                Su30MKI
                                last edited by Aug 6, 2018, 11:02 AM

                                I am literally trying. I am doing this NAT for the first time. Thank you very much for your help. I have not checked the result. But still let me complete this and will post the result.

                                1 Reply Last reply Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by Aug 6, 2018, 12:41 PM

                                  First thing I would do is setup your vip.. And then validate your seeing traffic to the vip before doing anything with any rules or 1:1 nat.. Since its not possible for pfsense to do anything with said traffic until it actually gets to pfsense wan.

                                  Maybe you have something between where your trying and pfsense wan that blocks 22 (ssh).

                                  Once you have traffic getting to pfsense on the port you want, then you can forward it to what you need be it with normal port forward or 1:1

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  21 out of 21
                                  • First post
                                    21/21
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                    This community forum collects and processes your personal information.
                                    consent.not_received