Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    public services access with NAT to the interal IP

    Installation and Upgrades
    3
    14
    224
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      popeel-SSH last edited by

      Hi,

      I am a new learner for pfsense.

      I have public IP which will need to connect to internal IP with port 80 and 443 for web services.

      How to archive this in the best way. It was very easy on CISCO ASA as there is a public service and add the public ip and service then add private ip and the service.

      Any help will be much appreciated.

      1 Reply Last reply Reply Quote 0
      • JeGr
        JeGr LAYER 8 Moderator last edited by

        @popeel-SSH said in public services access with NAT to the interal IP:

        I have public IP which will need to connect to internal IP with port 80 and 443 for web services.

        a public IP on the WAN interface or an additional public IP on the WAN?

        Otherwise you are simply talking (I think) about a "port forward". Go to NAT / Port forward, source any, destination "wan address", port 80, redirection IP <your internal IP> port 80 and do that again for 443.

        Some basic documentation reading is highly recommended though!

        https://docs.netgate.com/pfsense/en/latest/
        https://docs.netgate.com/pfsense/en/latest/book/

        Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

        If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

        1 Reply Last reply Reply Quote 0
        • P
          popeel-SSH last edited by

          Thanks. These docs are really helpful.

          Thanks. :)

          1 Reply Last reply Reply Quote 0
          • P
            popeel-SSH last edited by

            I have following rule from ASA to implement in pfsense. Not sure where I have done wrong. Please help and then I am done with this.

            firewall1.JPG

            This is the rule I will need to implement in pfsense.

            firewall2.JPG

            Not sure where I have done wrong and this isn't working.

            1 Reply Last reply Reply Quote 0
            • JeGr
              JeGr LAYER 8 Moderator last edited by JeGr

              On ASA you configured the rule on the inside / private interface so I assume the rule should allow the internal IP .100 to access port 80 on 80.156.2.133 on the internet?
              If that's the case you have to set it up on the LAN interface in pfSense as well, not on the WAN as you did.

              Or what is it, you try to achieve with that rule?

              Edit: Ah just saw it afterwards, that it's not a filter but a NAT rule. So you are trying to forward that 80... IP to 10.7.0.100 on the inside? Are you sure, that

              • 80.156.2.133 is actually configured in your pfSense setup (if it's not your WAN IP, is it configured as an Alias/VIP?)
              • If it's your actual WAN address: why don't you use <WAN address> or <This Firewall> as your Destination?

              Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

              If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

              1 Reply Last reply Reply Quote 1
              • P
                popeel-SSH last edited by

                Well I have an web server in internal network (10.7.0.100) and webserver external IP is 80.156.1.133.

                I would want firewall to redirect http traffice from 80.156.1.133 to internal ip 10.7.0.100 for external and internal people to access the website.

                Hope this make sense.

                1 Reply Last reply Reply Quote 0
                • JeGr
                  JeGr LAYER 8 Moderator last edited by

                  Sure. But did you read my edit? Is the IP .133 actually configured on the firewall? Or is that a subnet you're getting routed to you? Or is it the actual IP of the pfSense WAN IF?

                  Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                  If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                  1 Reply Last reply Reply Quote 1
                  • P
                    popeel-SSH last edited by

                    @JeGr said in public services access with NAT to the interal IP:

                    Is the IP .133 actually configured on the firewall? Or is that a subnet you're getting routed to you? Or is it the actual IP of the pfSense WAN IF?

                    This ip is part of the subnet of the WAN interface.

                    1 Reply Last reply Reply Quote 0
                    • JeGr
                      JeGr LAYER 8 Moderator last edited by

                      @popeel-SSH said in public services access with NAT to the interal IP:

                      This ip is part of the subnet of the WAN interface.

                      What's that? So you get something like .131 as your Gateway, .132 is pfSense and .133 you want to use for that web server? (as an example)?

                      Then you have to configure .133 as an Alias via Firewall/Virtual IP before the firewall can actually get traffic for it!

                      Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                      If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                      1 Reply Last reply Reply Quote 1
                      • P
                        popeel-SSH last edited by

                        IP is not the correct IP. I made that up for an example. Sorry not more specific.

                        OK. Please see see the below example.

                        IP address of the firewall 80.156.1.161
                        WAN Gateway 80.156.1.174

                        Public IP that will connect to the private server via port 80 is 80.156.1.163

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by

                          @popeel-SSH said in public services access with NAT to the interal IP:

                          Public IP that will connect to the private server via port 80 is 80.156.1.163

                          Did you set that up as a VIP on pfsense wan IP.. You can not forward from an IP that pfsense doesn't think is his..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                          1 Reply Last reply Reply Quote 1
                          • P
                            popeel-SSH last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 0
                            • P
                              popeel-SSH last edited by

                              Right. got it working.

                              Setup virtual IP and then create NAT rule match the virtual IP and not type the IP Address.

                              Thanks for the help. You are a real star.

                              Thanks again

                              1 Reply Last reply Reply Quote 0
                              • johnpoz
                                johnpoz LAYER 8 Global Moderator last edited by johnpoz

                                So /32 is not correct.. Should be using the mask of your netblock

                                vipmask.png

                                Then also run through the troubleshooting guide.
                                https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html

                                First thing I would do is actually validate traffic is hitting your wan with dest to that IP, with a packet capture.

                                edit: Oh you got it working - you deleted your last post saying you were still having issues.

                                Glad to hear.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post