Redirect anything Port 25 to port 3333 on lan
-
I have to redirect traffic from a 192.168.33.100 port 25 on lan to another lan ip 192.168.33.9 on port 3333.
My concept seems to work if I redirect to 33.9 port 25 as shown here:
But doest work if I change "Redirect target port" to 3333
33.9 is listening to both port, so that s not the issue.
Any ideas ?
Thanks for your time.
-
Huh? Why would 192.168.33.100 talk to pfsense when it wants to send traffic to its same network 192.168.33.9
Pfsense would not be involved in this conversation..
-
Sorry, forgot to say that 33.100 wants to talk on port 25 externally.
-
Well what your going to run into is since these are on the same network you run into a problem of asymmetrical traffic..
If you want to redirect, you want to put that dest on a different network than the source so you don't have asymmetrical or you would need to source nat it as well on pfsense outbound..
You run into this problem.
-
thanks for your time.
What I dont understand is why if I redirect port 25 to port 25 it works, but redirecting port 25 to 3333 doesnt work.
How one would "source nat it as well on pfsense outbound" ?
-
You would source nat with an outbound nat on your lan interface.
Not sure how you think its working with 25 to be honest... If box sends traffic to IP address 1.2.3.4 and get answer back from 192.168.33.9, why would it accept it??
your not talking UDP traffic here, and even with that you run into a problem when traffic come back from a different IP, etc.
-
I think it is working with port 25 because I do see incoming traffic on 33.9 and my postfix is processing it.
-
And you sure it redirected, where did the client think it was sending it??
from a security point of view what your saying will not work.. The client is being completely moronic in accepting the syn,ack back..
I send a syn to 1.2.3.4, why and the F would I accept a syn,ack back from 4.5.6.7
Now if you did just a domain override or something and client thought to send mail to domain.xyz talk to 4.5.6.7 then you don't have a problem.
-
ok you got me doubting for a while, but it does work when setup as screenshot in first post.
I tried from another computer, this time 192.168.33.104, and changed the rule to intercept trafic from that ip on port and did:
nc forum.netgate.com 25 < smtp_test_fileAnd the postfix instance on 33.9 responded.
Just doesnt work when redirect port is not the same as the destination port.
-
Not sure what your actually trying to accomplish... But your idea is not going to work in general principle... You would really need to put the destination you want to send traffic too on a different segment than your sending clients.
-
As Johnpoz has eluded to.. LAN traffic meant for other LAN devices never... Never touches the gateway. That would be your pfsense device in this conversation.
If you unplug power from your pfsense device LAN to LAN traffic will still work.
-
Seems like he is trying to redirect traffic dest to 1.2.3.4 to some 192.168.x address on the same segment as the sender..
This is never going to work, unless the client is from a security standpoint is just not even paying attention.. What OS is this this client..
I send a packet to 1.2.3.4, with mac abc.. (ip of dest mac of my gateway). My syn,ack comes back from 4.5.6.7 mac address xyz... (some other IP and not mac of gateway) Why would the client accept this traffic as a valid answer????
-
192.168.33.100 port 25 on lan to another lan ip 192.168.33.9 on port 3333
Seems like he is trying to redirect traffic dest to 1.2.3.4 to some 192.168.x address
Im probably lost in translation.. But yea.... no. :)
-
sorry for not being clear. Ill answer some of your questions to help you help me :)
The traffic from the LAN clients, emails on port 25, are meant to be sent externally using external mail servers. I want to catch them for testing purpose with the gateway when they are trying to leave and redirect the traffic on another box in the lan zone. (a postfix box) This is done so they dont spam the world... with their test.
I have 3 persons testing email clients with ip1, ip2 and ip3, I would have three rules one for each ip, with gateway ip0 redirecting external port 25 trafic to port1, port2 and port3 respectively on ip4.
So no, If I unplug the gateway, the traffic redirect wont happen anymore. It is bouncing of the gateway to another internal ip.
I think I understand what johnpoz is saying about:
@johnpoz said in Redirect anything Port 25 to port 3333 on lan:
I send a packet to 1.2.3.4, with mac abc.. (ip of dest mac of my gateway). My syn,ack comes back from 4.5.6.7 mac address xyz... (some other IP and not mac of gateway) Why would the client accept this traffic as a valid answer????
And I think this is what is happening when I set my rule to redirect external destination traffic on port 25 -> port 3333 on lan. But I still dont understand why it is working if I set my rule to redirect external destination traffic on port 25 -> port 25 on lan. I have tested this using windows 10 linux subsystem just using netcat to a random domain, in this case forum.netgate.com becuase any external domain will do and i was able to talk to the postfix instance locally and intercepting the email with the rules as configured in my first post.
Hope you better understand what I am trying to accomplish, and if you say that it is not possible, then I guess it is.
However, you seem to propose to put the postfix box on another subnet, but I am just unsure of how to accomplish this, and makes all the settings needed.
-
If you want to play NAT games like that you really should put the servers on a subnet different from the clients to avoid asymmetric routing and NAT reflection.
-
@camay123 said in Redirect anything Port 25 to port 3333 on lan:
but I am just unsure of how to accomplish this, and makes all the settings needed.
Create a vlan, or plug in a different dumb switch to another interface on pfsense. Put your box there on say 192.168.34/24
BTW, netcat test is not how the OS and application would work.. Do you not see the security problem with your setup? If that worked I could send traffic to any machine.. All I would have to do is hit a port that is currently being used in a conversation..
To trick/hide from the client that its not talking to 1.2.3.4 out of the public... You need to make sure where you redirect the traffic do doesn't answer from its own IP.. So simple way to do that is just put it on a different network then your client.
