Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Nat issues (port forwarding) across a private connection

    Scheduled Pinned Locked Moved NAT
    22 Posts 2 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bryanrh1
      last edited by

      I have a pfsense on the latest code. I have a layer2 private connection to site that houses the webserver. I have a public ip alias setup. When I try to connect to the webserver from the outside I never see the traffic leave the WAN interface.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        Your going to need to provide way more info than that if you want any sort of help.

        Drawing is where I would start!

        Why would you see traffic leave the wan?

        So you have this?

        internet --- publicIP-wan (pfsense1) ------ transit ----- (pfsense2) ---- server?

        So is pfsense2 also natting, or just firewall? Or just route? What are the networks involved here for your transit? etc..

        And your forwarding traffic on pfsense1 that hits your publicIP (wan) To this server IP..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • B
          bryanrh1
          last edited by

          Pfsense configuration -- Wan IP 208.x.x.x - Lan IP 172.17.21.1 -- Private connection IP - 10.247.1.137

          Route to 10.0.0.0/24 to 10.247.1.138

          Web server 10.0.0.13

          Would like to port forward port 80 to 10.0.0.13

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            @bryanrh1 said in Nat issues (port forwarding) across a private connection:

            Lan IP 172.17.21.1 -- Private connection IP - 10.247.1.137

            That is gibberish... How do you think your lan can talk to that IP?

            Your running 2 different L3 networks on the same L2? And want devices to talk? Where are you routing to 1.138?

            You mean you have another interface on pfsense that has this 10.247.1/?? Transit network? What is the mask on this transit? And then there is another pfsense at .138? And again is this natting, just firewall? What are the routes on the pfs2?

            Does it use pfs1 10.247.1.137 as its default gateway?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • B
              bryanrh1
              last edited by

              47c293ec-48f2-49a2-8303-f0203d024dc0-image.png

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Ok so what is the at 2nd router/pfsense setup to do..

                Can pfsense1 ping 10.0.0.13? Or is that 2nd pfsense natting?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • B
                  bryanrh1
                  last edited by

                  df146520-c9bb-403e-9e23-cf6f3de632af-image.png

                  1 Reply Last reply Reply Quote 0
                  • B
                    bryanrh1
                    last edited by

                    c48cb4a4-59ee-43a3-8a99-2248357550f3-image.png

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Well then if you can ping it from pfsense 1, all you should have to do is normal port forward to that IP on pfsense 1.. But you still have not stated what your pfs2 is doing, is running any firewall - then it would have to allow the traffic. What about firewalls on the webserver.

                      This comes down to basic troubleshooting of port forwarding.

                      Is the traffic actually even hitting your public IP, then sniff on 10.247.1.137 interface - do you see the traffic being sent to 10.0.0.13?

                      You would also have to worry about outbound nat of this downstream network on pfsense1, can 10.0.0.13 get to the internet, and does it gateway point back to pfsense2 for internet, which sends it to pfsense1?

                      https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • B
                        bryanrh1
                        last edited by

                        The ps2 is actually a edge router with no firewall. When I sniff on the pfsense wan interface I see the traffic.
                        7ac7df5b-3a01-4a5e-8b87-cf0de46e2f1b-image.png

                        when I sniff on the 50 meg interface I don't see any of the traffic .

                        1 Reply Last reply Reply Quote 0
                        • B
                          bryanrh1
                          last edited by

                          Sorry - I do see the traffic from the 50 meg interface.

                          325c4266-4666-4e92-adac-093ec26e4d75-image.png

                          B 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            Sure looks like you sent and got answers back to me.. From that sniff.

                            Maybe its him sending you back a RST.. If its not working

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • B
                              bryanrh1 @bryanrh1
                              last edited by

                              @bryanrh1

                              I have wireshark running on the webserver and I never see the traffic make it there. Still looking...

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                Well you see an response... So something freaking answered. Is it a RST?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • B
                                  bryanrh1
                                  last edited by

                                  a0b0d7ce-cc6c-476a-a71b-d52a3132ad0b-image.png

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Not sure why your seeing dups? But you see the syn and the syn,ack

                                    So something is answering ;)

                                    Where exactly are you sniffing.. You clearly have dups there..

                                    Oh those are not dupes - those are 2 different sessions.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bryanrh1
                                      last edited by

                                      I agree and I really appreciate your help today.

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        Those are not dupes - you have dual sessions there... See the seq number and the source ports.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bryanrh1
                                          last edited by

                                          On the edge router - because I never see the packets make it to the web server.

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            Well why is the edge router answering?? That is not its IP..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.