Internet access to VLAN webserver

FSolano

Hello,

First of all, thank you very much for your help in advance.

I am struggling to configure pfsense to grant access from the internet public IP, at the corresponding port, to a set of IP cameras, on http port, on a VLAN.

The pfsense interfaces configuration is: WAN - LAN - VLAN1 - VLAN2 - VLAN3 - VLAN4

LAN interface just host the NETGATE router on the private net 172.16.0.0/24
VLAN3 hosts the IP cameras on the private IP net 192.168.1.0/24

I have tried many different NAT and firewall rules with no luck. I would appreciate any help to make this work, because I am pretty sure it might be possible.

Kind regards.

Rico

So you have added your VLAN Interfaces? Then they behave like any other Interface and you can just follow the Forwarding Ports Guide:
https://www.netgate.com/docs/pfsense/nat/forwarding-ports-with-pfsense.html
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html

-Rico

Grimson

Never ever expose the web interface of IoT devices to the internet, doing so marks you as a complete idiot. Dial in via VPN to access those devices.

FSolano

Finally I solved last friday at the end of the day. I was just doing wrong the config in the firewall rules, basically because what I really needed to do is a correct NAT portforwarding. Thank you @Rico for your reply.

Regarding the stupidity @Grimson commented maybe he is right about IoT in most cases but this time the connection is not for an IoT device, sometimes its better to ask before assume. Anyway thank you for the advice.

Best regards,

Grimson

@fsolano said in Internet access to VLAN webserver:

Regarding the stupidity @Grimson commented maybe he is right about IoT in most cases but this time the connection is not for an IoT device, sometimes its better to ask before assume. Anyway thank you for the advice.

@fsolano said in Internet access to VLAN webserver:

I am struggling to configure pfsense to grant access from the internet public IP, at the corresponding port, to a set of IP cameras, on http port, on a VLAN.

IP cameras are IoT devices and among the worst offenders in the security field. You are free to be stupid, but don't come crying when your network gets compromised.

Babiz

@grimson
I'm not agree with you, why stupid?
I need for a ip cam like mobotix, to get direct internet access for some kind of stuff like "Door bell" and video phone calls to it after ringing, and my customers want simple setup at all.
I need to sleep good by night and not good if your customer call you everytime something trouble happen.
(Maybe customer is stupid but always I prefer to not add some security layer because is much hard to handle by my customers, of course in general "the customer" is normal humans, not nerd like me or paranoid like you) Bye!