Nat issues (port forwarding) across a private connection
-
I have a pfsense on the latest code. I have a layer2 private connection to site that houses the webserver. I have a public ip alias setup. When I try to connect to the webserver from the outside I never see the traffic leave the WAN interface.
-
Your going to need to provide way more info than that if you want any sort of help.
Drawing is where I would start!
Why would you see traffic leave the wan?
So you have this?
internet --- publicIP-wan (pfsense1) ------ transit ----- (pfsense2) ---- server?
So is pfsense2 also natting, or just firewall? Or just route? What are the networks involved here for your transit? etc..
And your forwarding traffic on pfsense1 that hits your publicIP (wan) To this server IP..
-
Pfsense configuration -- Wan IP 208.x.x.x - Lan IP 172.17.21.1 -- Private connection IP - 10.247.1.137
Route to 10.0.0.0/24 to 10.247.1.138
Web server 10.0.0.13
Would like to port forward port 80 to 10.0.0.13
-
@bryanrh1 said in Nat issues (port forwarding) across a private connection:
Lan IP 172.17.21.1 -- Private connection IP - 10.247.1.137
That is gibberish... How do you think your lan can talk to that IP?
Your running 2 different L3 networks on the same L2? And want devices to talk? Where are you routing to 1.138?
You mean you have another interface on pfsense that has this 10.247.1/?? Transit network? What is the mask on this transit? And then there is another pfsense at .138? And again is this natting, just firewall? What are the routes on the pfs2?
Does it use pfs1 10.247.1.137 as its default gateway?
-
-
Ok so what is the at 2nd router/pfsense setup to do..
Can pfsense1 ping 10.0.0.13? Or is that 2nd pfsense natting?
-
-
-
Well then if you can ping it from pfsense 1, all you should have to do is normal port forward to that IP on pfsense 1.. But you still have not stated what your pfs2 is doing, is running any firewall - then it would have to allow the traffic. What about firewalls on the webserver.
This comes down to basic troubleshooting of port forwarding.
Is the traffic actually even hitting your public IP, then sniff on 10.247.1.137 interface - do you see the traffic being sent to 10.0.0.13?
You would also have to worry about outbound nat of this downstream network on pfsense1, can 10.0.0.13 get to the internet, and does it gateway point back to pfsense2 for internet, which sends it to pfsense1?
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html
-
The ps2 is actually a edge router with no firewall. When I sniff on the pfsense wan interface I see the traffic.
when I sniff on the 50 meg interface I don't see any of the traffic .
-
Sorry - I do see the traffic from the 50 meg interface.
-
Sure looks like you sent and got answers back to me.. From that sniff.
Maybe its him sending you back a RST.. If its not working
-
I have wireshark running on the webserver and I never see the traffic make it there. Still looking...
-
Well you see an response... So something freaking answered. Is it a RST?
-
-
Not sure why your seeing dups? But you see the syn and the syn,ack
So something is answering ;)
Where exactly are you sniffing.. You clearly have dups there..
Oh those are not dupes - those are 2 different sessions.
-
I agree and I really appreciate your help today.
-
Those are not dupes - you have dual sessions there... See the seq number and the source ports.
-
On the edge router - because I never see the packets make it to the web server.
-
Well why is the edge router answering?? That is not its IP..
-
That is a very good question. After looking at the edge router there are some port forwarding for the wan interface for the same ports.
On Sunday I will delete all that port forwarding and try it again.
-
Lets us know how it turns out.. have to assume your forwarding the port to something else that is answering..
If just an router and not natting then there shouldn't be any forwards on it.. If its also firewalling - then should just be firewall rules allowing to stuff behind hit..
You sure its not natting? And just routing.
