Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Redirect anything Port 25 to port 3333 on lan

    Scheduled Pinned Locked Moved NAT
    16 Posts 4 Posters 844 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      camay123
      last edited by

      I have to redirect traffic from a 192.168.33.100 port 25 on lan to another lan ip 192.168.33.9 on port 3333.

      My concept seems to work if I redirect to 33.9 port 25 as shown here:

      c191c3f9-d7dd-4a3c-8962-45a4e436add2-image.png

      But doest work if I change "Redirect target port" to 3333

      33.9 is listening to both port, so that s not the issue.

      Any ideas ?
      Thanks for your time.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Huh? Why would 192.168.33.100 talk to pfsense when it wants to send traffic to its same network 192.168.33.9

        Pfsense would not be involved in this conversation..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • C
          camay123
          last edited by

          Sorry, forgot to say that 33.100 wants to talk on port 25 externally.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Well what your going to run into is since these are on the same network you run into a problem of asymmetrical traffic..

            If you want to redirect, you want to put that dest on a different network than the source so you don't have asymmetrical or you would need to source nat it as well on pfsense outbound..

            You run into this problem.

            asymetrical.jpg

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • C
              camay123
              last edited by

              thanks for your time.

              What I dont understand is why if I redirect port 25 to port 25 it works, but redirecting port 25 to 3333 doesnt work.

              How one would "source nat it as well on pfsense outbound" ?

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                You would source nat with an outbound nat on your lan interface.

                Not sure how you think its working with 25 to be honest... If box sends traffic to IP address 1.2.3.4 and get answer back from 192.168.33.9, why would it accept it??

                your not talking UDP traffic here, and even with that you run into a problem when traffic come back from a different IP, etc.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • C
                  camay123
                  last edited by

                  I think it is working with port 25 because I do see incoming traffic on 33.9 and my postfix is processing it.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    And you sure it redirected, where did the client think it was sending it??

                    from a security point of view what your saying will not work.. The client is being completely moronic in accepting the syn,ack back..

                    I send a syn to 1.2.3.4, why and the F would I accept a syn,ack back from 4.5.6.7

                    Now if you did just a domain override or something and client thought to send mail to domain.xyz talk to 4.5.6.7 then you don't have a problem.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • C
                      camay123
                      last edited by

                      ok you got me doubting for a while, but it does work when setup as screenshot in first post.

                      I tried from another computer, this time 192.168.33.104, and changed the rule to intercept trafic from that ip on port and did:

                      nc forum.netgate.com 25 < smtp_test_file
                      

                      And the postfix instance on 33.9 responded.

                      Just doesnt work when redirect port is not the same as the destination port.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        Not sure what your actually trying to accomplish... But your idea is not going to work in general principle... You would really need to put the destination you want to send traffic too on a different segment than your sending clients.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • chpalmerC
                          chpalmer
                          last edited by

                          As Johnpoz has eluded to.. LAN traffic meant for other LAN devices never... Never touches the gateway. That would be your pfsense device in this conversation.

                          If you unplug power from your pfsense device LAN to LAN traffic will still work.

                          Triggering snowflakes one by one..
                          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            Seems like he is trying to redirect traffic dest to 1.2.3.4 to some 192.168.x address on the same segment as the sender..

                            This is never going to work, unless the client is from a security standpoint is just not even paying attention.. What OS is this this client..

                            I send a packet to 1.2.3.4, with mac abc.. (ip of dest mac of my gateway). My syn,ack comes back from 4.5.6.7 mac address xyz... (some other IP and not mac of gateway) Why would the client accept this traffic as a valid answer????

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • chpalmerC
                              chpalmer
                              last edited by

                              192.168.33.100 port 25 on lan to another lan ip 192.168.33.9 on port 3333

                              @johnpoz

                              Seems like he is trying to redirect traffic dest to 1.2.3.4 to some 192.168.x address

                              Im probably lost in translation.. But yea.... no. :)

                              Triggering snowflakes one by one..
                              Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                              1 Reply Last reply Reply Quote 0
                              • C
                                camay123
                                last edited by

                                sorry for not being clear. Ill answer some of your questions to help you help me :)

                                The traffic from the LAN clients, emails on port 25, are meant to be sent externally using external mail servers. I want to catch them for testing purpose with the gateway when they are trying to leave and redirect the traffic on another box in the lan zone. (a postfix box) This is done so they dont spam the world... with their test.

                                I have 3 persons testing email clients with ip1, ip2 and ip3, I would have three rules one for each ip, with gateway ip0 redirecting external port 25 trafic to port1, port2 and port3 respectively on ip4.

                                So no, If I unplug the gateway, the traffic redirect wont happen anymore. It is bouncing of the gateway to another internal ip.

                                I think I understand what johnpoz is saying about:

                                @johnpoz said in Redirect anything Port 25 to port 3333 on lan:

                                I send a packet to 1.2.3.4, with mac abc.. (ip of dest mac of my gateway). My syn,ack comes back from 4.5.6.7 mac address xyz... (some other IP and not mac of gateway) Why would the client accept this traffic as a valid answer????

                                And I think this is what is happening when I set my rule to redirect external destination traffic on port 25 -> port 3333 on lan. But I still dont understand why it is working if I set my rule to redirect external destination traffic on port 25 -> port 25 on lan. I have tested this using windows 10 linux subsystem just using netcat to a random domain, in this case forum.netgate.com becuase any external domain will do and i was able to talk to the postfix instance locally and intercepting the email with the rules as configured in my first post.

                                Hope you better understand what I am trying to accomplish, and if you say that it is not possible, then I guess it is.

                                However, you seem to propose to put the postfix box on another subnet, but I am just unsure of how to accomplish this, and makes all the settings needed.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by Derelict

                                  If you want to play NAT games like that you really should put the servers on a subnet different from the clients to avoid asymmetric routing and NAT reflection.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    @camay123 said in Redirect anything Port 25 to port 3333 on lan:

                                    but I am just unsure of how to accomplish this, and makes all the settings needed.

                                    Create a vlan, or plug in a different dumb switch to another interface on pfsense. Put your box there on say 192.168.34/24

                                    BTW, netcat test is not how the OS and application would work.. Do you not see the security problem with your setup? If that worked I could send traffic to any machine.. All I would have to do is hit a port that is currently being used in a conversation..

                                    To trick/hide from the client that its not talking to 1.2.3.4 out of the public... You need to make sure where you redirect the traffic do doesn't answer from its own IP.. So simple way to do that is just put it on a different network then your client.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 1
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.