• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Enable internet access from LAN

Scheduled Pinned Locked Moved General pfSense Questions
50 Posts 4 Posters 10.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    maale @stephenw10
    last edited by Apr 6, 2020, 5:21 PM

    @stephenw10
    yes I have only changed the WAN rules to alow ICMP.
    064cb4aa-c5fa-4104-acff-9db37f1b69ec-image.png .
    thanks

    1 Reply Last reply Reply Quote 0
    • S
      stephenw10 Netgate Administrator
      last edited by Apr 6, 2020, 5:37 PM

      Ok, what ports do you have in the web alias?

      M 1 Reply Last reply Apr 6, 2020, 5:42 PM Reply Quote 0
      • M
        maale @stephenw10
        last edited by Apr 6, 2020, 5:42 PM

        @stephenw10
        26f951e2-b552-4c1a-a3af-87d8bbb7ea29-image.png

        1 Reply Last reply Reply Quote 0
        • S
          stephenw10 Netgate Administrator
          last edited by Apr 6, 2020, 5:50 PM

          Ok it looks like your port forward for that server is listing at 104.x.x.5 but you are trying to open 104.x.x.35.
          Is that just a typo? Correct it if so.

          If it's a VIP on the WAN then try to open that IP.

          Steve

          M 1 Reply Last reply Apr 6, 2020, 6:11 PM Reply Quote 0
          • M
            maale @stephenw10
            last edited by Apr 6, 2020, 6:11 PM

            @stephenw10
            I have 2 servers, one is web sever has external IP 104.190.X.X.5 and internal 192.168.1.5, second is mail server has external IP 104.X.X.35 with internal IP 192.168.1.5, I want both be behind pfsense and accessible from outside through port forwarding
            3118887d-69a1-4875-8d1f-ac7aaea1b662-image.png
            yes I have virtual IPs
            sorry, what do you mean by opening that IP?
            do you mean set a LAN rule with destionation address =104.x.x.5 ?

            M 1 Reply Last reply Apr 6, 2020, 6:17 PM Reply Quote 0
            • M
              maale @maale
              last edited by Apr 6, 2020, 6:17 PM

              @maale
              Sorry, I mean a WAN rule

              1 Reply Last reply Reply Quote 0
              • S
                stephenw10 Netgate Administrator
                last edited by Apr 7, 2020, 5:31 PM

                I mean try to open the page by IP address directly rather than URL which would need to resolve.

                Both those IPs look like they should work though assuming the server can respond.

                Check the pfSense state table in Diag > States while you;re testing. You should see the states on WAN and LAN complete with NAT on WAN.

                Steve

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by Apr 7, 2020, 5:35 PM

                  So what is your actual IP of your pfsense wan? You have vips of .5 and .35 - what is the actual IP?

                  Have you gone through the troubleshooting doc I Linked too - finding the issue with port forwarding is 2 minutes work tops!!! do a sniff do you see the traffic on your wan or not? Sniff on lan - do you see it send the traffic on?

                  For all you know the traffic is being forwarded and your system your forwarding to firewall is blocking the traffic - very common!!!

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  M 1 Reply Last reply Apr 8, 2020, 6:57 PM Reply Quote 0
                  • M
                    maale @johnpoz
                    last edited by Apr 8, 2020, 6:57 PM

                    @johnpoz
                    Thanks!

                    The problem was that the routing environment doesnot support Virtual IPs.
                    All traffic should be hit the pfsense WAN IP at 104.x.x.10 .So, I have set an external DNS with an IP 104.x.x.25 with my domain and records www.x.av for web server and mail.x.av for mail server, with port forward rules.
                    b2404f7e-03cb-43c8-89c0-f9acec5b054b-image.png
                    Now from an external machine 104.x.x.15 using the domain www.x.av I can access the web server, but using the domain mail.x.av, this directs me to the same webpage for the web server but not for the mail server. Is NAT reflection what I need to do?

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Apr 8, 2020, 7:00 PM

                      @maale said in Enable internet access from LAN:

                      routing environment doesnot support Virtual IPs.

                      Huh - that makes no sense at all.

                      Is NAT reflection what I need to do?

                      No its not... if you want host.domain.tld to get sent to X, and other.domain.tld to get send to Y behind pfsense then you need to use multiple wan IP, vips or not... Or you need to hit different ports in your url, or you need to setup a reverse proxy to know that host.domain.tld goes to X and that other.domain.tld goes to Y.. Look at the HA proxy package.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      M 1 Reply Last reply Apr 8, 2020, 8:01 PM Reply Quote 0
                      • M
                        maale @johnpoz
                        last edited by Apr 8, 2020, 8:01 PM

                        @johnpoz
                        I mean the lab routing environment.
                        ok I look for the HA package

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by Apr 8, 2020, 8:09 PM

                          Lab routing environment or real routing environment... Has zero to do with anything - an IP address that is in same network, has zero to do with routing...

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • S
                            stephenw10 Netgate Administrator
                            last edited by Apr 8, 2020, 8:59 PM

                            Mmm, that.

                            Why can you not use multiple IPs on WAN? What VIP type were you trying to use? Use IPAlias if you were not.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Apr 8, 2020, 9:10 PM

                              Maybe he meant their virtual environment that pfsense is running on? Maybe issues with vips in some VM setups, where you might have to do some promiscuous setting. But if VM, he could just create some new virtual interfaces and since he is using dhcp in this network.. He could have 3 different wan interfaces using 3 different IPs and then port forward..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              M 1 Reply Last reply Apr 8, 2020, 10:27 PM Reply Quote 0
                              • M
                                maale @johnpoz
                                last edited by Apr 8, 2020, 10:27 PM

                                @johnpoz
                                I am trying to install the HA proxy package, but I cannot see any packages listed. could you please let me know why? I can connect to www.pfsense.org successfully. And I have installed bind package before, but now a I cannot find available packages
                                80f14da4-ad0c-4c25-8e47-8e9e8f542b7f-image.png

                                1 Reply Last reply Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz Apr 8, 2020, 11:01 PM Apr 8, 2020, 11:00 PM

                                  That because your pfsense install can not resolve most likely, since you prob installed bind and F'd it up..

                                  Go to diagnostic menu, dns - lookup up something.. what does it show..

                                  You connecting to something is completely different than pfsense resolving something.. What is your client using for dns, what is pfsense?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  M 1 Reply Last reply Apr 8, 2020, 11:23 PM Reply Quote 0
                                  • M
                                    maale @johnpoz
                                    last edited by Apr 8, 2020, 11:23 PM

                                    @johnpoz
                                    I am using the pfsense DNS resolver and other 2 external DNS servers. diagnostic menu, dns - lookup google.com, gave no response from 127.0.0.1 but response from one of my external servers with google's IP address.

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by Apr 8, 2020, 11:25 PM

                                      @maale said in Enable internet access from LAN:

                                      I am using the pfsense DNS resolver and other 2 external DNS servers

                                      Not how it works - you are either resolving, or your using external dns via forwarding..

                                      Your resolver is not working most likely because whatever network pfsense is on is prob blocking direct dns queries - and only allows access to googledns or whatever.

                                      So change to forwarder mode..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      M 2 Replies Last reply Apr 8, 2020, 11:36 PM Reply Quote 0
                                      • M
                                        maale @johnpoz
                                        last edited by Apr 8, 2020, 11:36 PM

                                        @johnpoz
                                        Thanks so much, now I can see the available package list

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          maale @johnpoz
                                          last edited by Apr 12, 2020, 5:30 PM

                                          @johnpoz
                                          Because I am using the same domain name for my internal and external services, I have used the bind9 package to set split DNS as follows and it works fine to resolve inside LAN and outside. All services from outside have pfsense WAN address.
                                          This is first zone file for internal addresses.
                                          74dff8fe-c1a8-4af4-bd8b-3f3185fbaa72-image.png
                                          This is the second zone for external addresses.
                                          613641e6-26d7-44c7-8542-0b88ec4d9eb3-image.png
                                          I also have set a NAT rule with destination= 127.0.0.1 port 53 in the LAN and WAN interfaces. So that split DNS works fine.
                                          80ecd5fe-6718-47f9-8921-ed1ddaaa433b-image.png
                                          6c6530a4-af96-4f3e-9bba-bd8e66066372-image.png

                                          Because all services have pfsense WAN address I used the squid reverse proxy package with the web and mail servers at 192.168.1.5 and 192.168.1.35. I want www.x.av goes to the internal web server at 192.168.1.5 port 80. And https://mail.x.av goes to the mail server at 192.168.1.35 port 443 and 143.
                                          5f3494c9-524d-4331-8da1-1f293e8b70f5-image.png
                                          . I set a WAN rule with source any destion :this firewall port 80 so that the traffic goes to the squid reverse proxy. That doesnot work for me, from outside I cannot access any of the two servers! Could you please let me know what is wrong with this setting?
                                          Thanks.

                                          1 Reply Last reply Reply Quote 0
                                          31 out of 50
                                          • First post
                                            31/50
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received