simple rule to give samba (or ftp) access to a single WAN IP to a FreeNAS (on LAN)

polopolo92 · May 30, 2020, 12:59 PM

Hello

I am new with Pfsense
I read a lot but I cannot perform a simple port translation to allow one windows host on the wan (from his IP) to access to a freenas using Samba (port 445) or ftp (port 21) located on the LAN.

I added the windows WAN IP in the WAN rule, redirected the ports to the Freenas IP on the LAN but I cannot mount a Samba share (or a ftp share)

It works if I put the Freenas on the WAN so I don't think it is a Freenas permission issue.

Any track to fix a quite simple rule ?

Thanks a lot for help.

johnpoz · May 30, 2020, 1:09 PM

This is all of 30 seconds... You create your port forward, it auto creates your firewall rules.. It really is that simple..

If your having issues then go through the troubleshooting guide.
https://docs.netgate.com/pfsense/en/latest/book/nat/troubleshooting.html

Off the top I would "guess" your blocking rfc1918 on your wan.. So no your port forward is not going to work if your wan devices are rfc1918.. which it sounds like it is when you say host on your wan.

Next thing I would guess is firewall on where your trying to send this traffic.. Host firewalls tend to block shit from networks that are not their local network right out of the box.

polopolo92 · May 30, 2020, 1:19 PM

Thanks for the prompt anwser, appreciated.

I did the NAT port forwarding and it created the rules .
I'll follow the recommanded guide for NAT, thanks

I do not understand what you mean by blocking rfc1918 , I did not check it in "Interface / WAN / Reserved Networks"

The "architecture" is :
Windows PC (try to mount SAMBA) -> Internet -> pfSense WAN -> pfSense LAN -> FreeNAS LAN (Samba Share)

Regards

johnpoz · May 30, 2020, 1:22 PM

@polopolo92 said in simple rule to give samba (or ftp) access to a single WAN IP to a FreeNAS (on LAN):

I do not understand what you mean by blocking rfc1918 , I did not check it in "Interface / WAN / Reserved Networks"

Out of the box pfsense blocks rfc1918 on the wan, so unless you turned it off on purpose it is there... Just look at your wan rules.. Post them - bogon and rfc1918 are blocked out of the box on wan interface.

-> Internet ->

That is not WAN... That is internet - You said you put your freenas on the wan network, etc..

Your not going to be able to do SMB (samba) over the public internet! And ftp are you passive or active..

polopolo92 · May 30, 2020, 1:42 PM

yes i turned off "Block bogon netwoks" and "block pivate networks"

sorry for me the WAN is Internet. PfSense is connected to the WAN (Internet) , Freenas not (only LAN)

[Your not going to be able to do SMB (samba) over the public internet!]

Why ? I can if I put directly the FreeNas on internet (now I have deconnected it and that is the reason I want to put Pfsense in the middle.

johnpoz · May 30, 2020, 1:58 PM

@polopolo92 said in simple rule to give samba (or ftp) access to a single WAN IP to a FreeNAS (on LAN):

sorry for me the WAN is Internet.

No it is not... Wan net is just that Wan Net... So you just put your freenas on the public internet directly and then you saying samba worked?? Pretty much every isp on the planet blocks samba..

example
https://www.xfinity.com/support/articles/list-of-blocked-ports

https://www.cox.com/residential/support/internet-ports-blocked-or-restricted-by-cox.html

here
https://about.att.com/sites/broadband/network

Blocking SMB.. Pretty much any major player would block SMB..
https://www.spectrum.net/support/internet/blocked-ports/

Do I Need to go on??

If you want to share files across the internet with someone using smb - then setup a vpn connection between you. Be it remote user or site to site..

Sniff on your wan for port 445... Now go to say can you see me . org testing for 445... So you see that traffic hit pfsense wan IP? If not then its blocked upstream from pfsense..

Even if your open, doesn't mean that users isp allows it out... Or that everywhere between will allow it.. You don't do SMB over the public internet..

polopolo92 · May 30, 2020, 3:33 PM

Thanks for explanation

Yes Samba was working very fine for me when I connected the NAS on it earlier.
I did not know it was not recommanded to use Samba (I know that the NAS itself should not be connected to internet)

I'll follow your recommandations and look for ftp to share or VPN for Samba

polopolo92 · May 30, 2020, 8:11 PM

So I installed a VPN : OpenVPN Server on Pfsense , and the client on Window using "export client"

It works fine, now I can access to Pfsense UI using it's LAN IP (192.168.1.1) but not to the NAS LAN IP (192.168.1.3)

I put 192.168.1.0/24 into " IPv4 Local network(s) "
Something missing to access to other hosts on the LAN ?

Thanks

johnpoz · May 30, 2020, 8:13 PM

Its quite possible your problem is firewall on your nas not allowing any sort of access from a network other than its own local network..

polopolo92 · May 30, 2020, 8:33 PM

@johnpoz
I found the issue : I added a route in the NAS for the LAN putting pfsense as gateway and it works !

Thanks

johnpoz · May 30, 2020, 8:40 PM

Well if your NAS is multihomed and not pointing to pfsense as its default gateway - then yeah going to be a problem connecting to it from a network it has no idea how to get back to.