Accessing my own backup service

velourpappa

Hi,

I'm trying to access my own backup service from LAN with the IP:port of the WAN side. The port seems to be closed from inside my LAN, but not from outside. I'm doing this because I want to configure the backup client with external IP and port, so the backup works when I'm using my laptop outside my LAN.

Do I have to add any rule in pfSense to get this working?

Setup
(numbers are changed)

External IP: 98.128.171.45
Port exposed by router on WAN side: 12345. Including NAT rule.
The backup service running on LAN with IP 192.168.5.123:12345
The backup client on laptop is configured to use 98.128.171.45:12345 (External IP) when connecting to the backup service.

What is happening?

The port 12345 is accessible from internet. Tested from ShieldsUP
The backup client fails to connect to the backup service when the laptop is on LAN.
The backup client can connect and backup when the laptop is using VPN.
I can see the traffic (in pfSense webUI) from my laptop on LAN being passed to the external IP 98.128.171.45:12345 by this rule:
For some reason the ports 22, 80, 443 (maybe more) are reported as open from pfSense Command Prompt, but on ShieldsUP they are stelth:

$ nc -z -v -w4 98.128.171.45 12345
connect to 98.128.171.45 port 12345 (tcp) failed: Operation timed out

$ nc -z -v -w4 98.128.171.45 80
Connection to 98.128.171.45 80 port [tcp/http] succeeded!

A similar setup is working on another site, but with an Unifi-router and another ISP. Only with port forwarding rules on the router.

Thank you! Tomas

stephenw10

The correct way to do this is using a hostname and split DNS so it resolves to the internal IP when you're on LAN but you can also just enable NAT reflection.

https://docs.netgate.com/pfsense/en/latest/nat/accessing-port-forwards-from-local-networks.html

Steve

velourpappa

Thank you!

Solved it by enabling NAT reflection on the port forward rule.

/Tomas