Pfsense on Virtualbox's Guest + Emby(Plex) on VirtualBox's Host

  • Hello, This is my problem :
    i've installed pfsense in virtualbox in a windows 10 host, bridge configuration. On same that computer I've also install Emby (which is media server).
    The captive portal in pfsense is working just fine. But now I want to allow my friends to access my media server (Emby), which is on the host.

    • Pfense WAN IP :
    • Media Server (on host) IP wih port :
    • Pfsense LAN adress : - 255

    So what can I do to allow IP like to access ?

    Sorry for my bad english.
    thank you for the help.

  • Netgate Administrator

    So how are your friends accessing pfSense? VPN? Some port forward?

    pfSense does not appear to be filtering traffic to Emby there, it's in the pfSense WAN subnet, so you could probably just port forward to Emby in your upstream router.

    If it's is via VPN though you just need to be passing a route to the Emby IP and have a firewall rule to allow it.


  • They use the captive portal that i've enabled for them.
    I've not test port forward because I can't even reach that IP with port 80.
    Tell me how to do the port forward, I'll try.

    Thank You.

  • I confirm access to Emby, if Emby is in LAN (192.168.100.), but if it's in no access WAN (192.168.1.).
    there is no way to access ip 192.168.1.* from 192.168.100.* ?

    Plz help.

  • Netgate Administrator

    So the clients trying to access it are coming from the subnet? Is that not internal to VBox only?

    Which subnet is inside VBox? Usually it would be the LAN.


  • Yes they are coming from subnet and is internal to the virtualBox. and that subnet is the LAN. You get it correctly.

  • I've tried to access via internet (Emby) but I think Pfsense do not like loopback. I'm out of ideas.

  • Netgate Administrator

    pfSense will route traffic from LAN to WAN by default and will NAT the traffic to the WAN IP. Any host on LAN should be able to connect to as long as there is a firewall rule on LAN to allow it.

    I'm still unsure how your 'friends' are connecting from the LAN subnet when it's an internal VBox subnet.


  • In the config of my VBox, I've enabled 2 Network adapters, the first one is in brigde mode with the wifi physical adapter, and the second with the RJ45 physical adapter. So Internet is coming from the wifi and the RJ45 is the LAN for my friends. RJ45 is connnected to a router as simple AP (DHCP disabled).

    Maybe my config is not good for such thing ? But it's working to share internet access.

  • Netgate Administrator

    Ah OK, I see now!

    So, yes, that should work with the default config. The Emby server is WAN side so pfSense will route/NAT all LAN traffic to it as long as the firewall rules allow it.

    If it is not reachable it's probably a problem with the captive portal setup.

    Check for blocked traffic in the firewall logs.

    Check for states opened to the Emby server in Diag > States.

    If you're using policy routing you might be bypassing local networks which would break that.


  • I've tried again just now, see what log shows me :

    IP is the target, but as you see, it's blocked.
    I've checked also states, i've seen no reference to that IP.

    Thank you.

  • Netgate Administrator

    That's incoming netbios broadcasts from Emby. That should be blocked on WAN.

    If you see no states when you are trying to connect to it from LAN then you have something misconfigured. Probably captive portal. Maybe DNS if you are not trying to connect by IP address.


  • I know its a long image, but please let me show you my CP settings :

    I'm using DNS Resolver :

    What can I change ? since I'm using Pfsense, I did not touch DNS settings.

  • Netgate Administrator

    What are your LAN firewall rules?

    How exactly are clients trying to connect to Emby?

  • here is my LAN firewall rules :

    I will like to let them access my media server after logged via the Captive Portal.
    For now they're just using it for internet.

  • Netgate Administrator

    Right, but how are they trying to access it? What error are they seeing?

  • The browser says Adress Unreachable...

  • Netgate Administrator

    What address are they trying to go to? What does Emby expect?

    If there are no states it looks like the clients are not even trying so I would guess what's happening is clients are tryting to fo to emby.local.lan or some such but that is not resolvable behind pfSense.


  • Emby is on so I tried to connect to it from browser with that IP, no hostname. About states, I swear that I've tried with my phone. Clients are not trying because Its not working yet to tell them.
    How can I make that IP to be resolvable behind pfsense ? Its too weird for me...

  • Netgate Administrator

    OK if you're trying to connect by IP address that should work. pfSense will route that traffic to the WAN because it is in that subnet directly.
    It sounds like maybe clients are not using pfSense as the route to that subnet? You should be seeing states opening from clients if they were.


  • Hello, Thank you for all our replies. I'm on the way o fix my issue but please, is that a way to hide the access to an IP (LAN) behind the captive portal ?

  • Netgate Administrator

    Yes, you can just block/reject connections from that IP to the server using a firewall rule on WAN. Just put of above the pass rule(s).


  • I finally fix IP to the LAN side of the host (WIN 10 - RJ45), the one I connect to the router that clients. So Now Emby is in the same network like the clients so, is now accesible via, and without Authentification, thats the problem now.
    I dont want to block connection to that IP, I want them to log in before access to that IP, even if its in LAN

  • Netgate Administrator

    If it's in the same subnet as the clients connecting to it that traffic never goes through pfSense so it cannot filter it. Or act on it in any way such as applying captive portal login.


  • Hello, thank you for your patience and replies.

    Please is that a way to open a new web to client after authentificate ?

    The problem is that, on mobile device, after authentificate, the redirect page closes itself.

    Thank you

  • Netgate Administrator

    The 'After authentication Redirection URL' page from the captive portal?

    If their browser closes it there's not much you can do. Once the CP is passing their traffic it does not redirect them again unless they are logged out.


  • @stephenw10 Ok, It's too bad....
    For users, It's that a way to create a period of validity ? For exemple I create a voutcher of 1440 minute (24h) of internet access, which can be valid for 3 days. Means He can connect himself when he wants.

  • Netgate Administrator

    Hmm, I'm not sure if you can set an expiry date for vouchers. You can obviously remove them manually.

  • @stephenw10 Lol For all users, No I can't. Is it possible with user account (username and password) ?

  • Netgate Administrator

Log in to reply