Access host on the LAN using public IP

michaeldemb · Mar 19, 2020, 1:33 PM

Hi,
I was not able to find a solution to this problem.
What I am trying to do, is be able to access a host inside my LAN via a public IP that has NAT on my WAN interface.

--------->Public IP 100.100.100.100 ----> [FW with NAT]------LAN-----HOST 1.1.1.1
|
--------Client opn the LAN wants to access the HOST using 100.100.100.100 address

I have configured virtual IP on the FW and created NAT entry for the 1.1.1.1 address. I am able to access from outside with the 100.100.100.100 address. However, when trying to access from inside using same public IP, I am getting the webpage of the FW itself, instead of the HOST.

Thanks.

kiokoman · Mar 19, 2020, 3:33 PM

you need nat reflection
https://docs.netgate.com/pfsense/en/latest/book/nat/nat-reflection.html

johnpoz · Mar 19, 2020, 3:59 PM

No he doesn't NEED nat reflection - why can you not just access this resource while your inside your network via the fqdn that you set on your local dns to resolve to the local IP... This is a cleaner, better solution than nat reflection.

michaeldemb · Mar 19, 2020, 4:10 PM

@kiokoman this does not work. I tried both options.

michaeldemb · Mar 19, 2020, 4:26 PM

@johnpoz Because I must use an IP address. Can't use host name. Some limitations of an application I am using. Any other ideas on how to make it working?

johnpoz · Mar 19, 2020, 4:57 PM

@michaeldemb said in Access host on the LAN using public IP:

Because I must use an IP address

Use a different application - forcing use of an IP is just plain moronic... What application is this?

michaeldemb · Mar 19, 2020, 5:27 PM

@johnpoz This is not an option.

michaeldemb · Mar 19, 2020, 5:33 PM

@johnpoz BTW, I did set DNS Forwarder Host Overrides, but it does not seem to be working. PF still resolves to the actual public IP, not the one I configured.

johnpoz · Mar 19, 2020, 5:37 PM

Well nat reflection does work - but all things are options... Why is it you have to use this software, your saying nobody else makes software that does X... And their software is so shitty that it can not even use a fqdn.... Sorry but say its BS..

If you want help with with your nat reflection setup, your going to have to provide some details.. I would start with showing us your nat reflection setup.

2nd I would do a sniff do you see pfsense reflect the traffic back in..

I did set DNS Forwarder Host Override

Are you using the forwarder? Out of the box pfsense uses resolver, unbound... So setting overrides in the forwarder would accomplish nothing.. Set the override in resolver, not forwarder... This takes 2 seconds to validate if working or not with a simple query.

michaeldemb · Mar 19, 2020, 5:38 PM

@johnpoz Lets assume I can use DNS. Why DNS Forwarder Host Overrides is not working?

johnpoz · Mar 19, 2020, 5:42 PM

Again... Are you using the forwarder? There are two DNS software packages (3 if you install bind optional package) on pfsense.. There is the forwarder (dnsmasq), and the resolver (unbound)... Out of the box pfsense uses unbound.

You have to place your override in the system your using.. Its that simple

michaeldemb · Mar 19, 2020, 5:47 PM

@johnpoz I am using Forwarder (dnsmasq).
All is configured, but the PF still responding with the value from public DNS rather than from the overwrite entry. See screenshot:

kiokoman · Mar 19, 2020, 6:08 PM

@johnpoz yeah i need to be more verbose next time, i was in a hurry because a customer entered my store in that moment what i meant is you need one of the options on that link, nat reflection or split dns but it's well documented that split dns is the best course of action

johnpoz · Mar 19, 2020, 6:14 PM

Well your not asking pfsense - so why would you think it would reply with your override?

Your override is not on freaking googles dns servers for gosh sake!

kiokoman · Mar 19, 2020, 6:21 PM

kiokoman@nanto:~$ dig @172.17.0.254 -p110 any ilive.demb.ca
;; Connection to 172.17.0.254#110(172.17.0.254) for ilive.demb.ca failed: timed out.

; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @172.17.0.254 -p110 any ilive.demb.ca
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21705
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ilive.demb.ca.                 IN      ANY

;; ANSWER SECTION:
ilive.demb.ca.          1       IN      A       192.168.10.10

;; Query time: 3 msec
;; SERVER: 172.17.0.254#110(172.17.0.254)
;; WHEN: gio mar 19 19:17:56 CET 2020
;; MSG SIZE  rcvd: 58

dig @ pfsense-ip !!

and your pc need to use pfsense as dns server and only that

michaeldemb · Mar 19, 2020, 6:25 PM

@johnpoz Man, you need to better pay attention to questions. I am asking PF, but for some reason, it is forwarding the request to upstream DNS, instead of returning the value from overwrite table.

johnpoz · Mar 19, 2020, 6:28 PM

@michaeldemb said in Access host on the LAN using public IP:

you need to better pay attention to questions

You are NOT asking pfsense - its right there in front of you!!

You clearly have set pfsense to ask google - it doesn't do that out of box... Set pfsense to ask itself, which is the default! And then test your override asking it..

michaeldemb · Mar 19, 2020, 6:29 PM

@johnpoz PF is set as my default DNS. It is configured with DNS forwarder that goes to google. So yes I am asking PF, but it just forwarding to google.

johnpoz · Mar 19, 2020, 6:33 PM

@michaeldemb said in Access host on the LAN using public IP:

So yes I am asking PF, but it just forwarding to google

NO your NOT.. Your queries were direct to 8.8.8.8 - its right there in your screenshots!!

kiokoman · Mar 19, 2020, 6:42 PM

if it's not like the screenshot of johnpoz check this options