External ssh login to LAN computer

zkab

I have OpenVPN running on pfSense 2.5.4 where I have created users with certificates ... and it works OK.

Since there is an issues with one of my LAN Computer (IP 192.168.1.y) a service guy wants to 'ssh login' to (IP 192.168.1.y) from
an external computer (IP x.x.x).

How can I tell OpenVPN that only IP (x.x.x) can 'ssh login' to (IP 192.168.1.y) and that is the only access to my LAN ... they can't do anything else.

viragomann

@zkab
You need to configure a CSO for the client. VPN > OpenVPN > Client specific overrides.
So you can assign a specific IP to the client. State a high IP from the tunnel network.

Then you can use this IP in firewall rule on the OpenVPN tab to allow only the desired access.

zkab

Thanks ... still confused but at a higher level.
My knowledge in firewalls could be better ... trying to learn more.
Is there a documentation showing more in detail how to proceed?

johnpoz

@zkab said in External ssh login to LAN computer:

pfSense 2.5.4

Huh? Sure hope you didn't mean 2.4.5 you should update. But there is not 2.5.4

https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-multi-purpose.html#openvpn-client-specific-overrides

zkab

Sorry ... I have 'Version 2.5.2-RELEASE (amd64)'
I will check the link ...

@zkab said in External ssh login to LAN computer:

can 'ssh login' to (IP 192.168.1.y) and that is the only access to my LAN

ok, i can help you let's go to your firewall rule and your openvpn configuration please.

zkab

Maybe I have mixed up things with OpenVPN.
Basically what I want is to 'ssh login' to a LAN computer 192.168.1.x from an external IP from Internet.
Is there away to set up a rule that allows the connection ... without involving OpenVPN.
Since ssh is running I have tested to 'ssh login' to my WAN address and it works OK.

@silence post delete?

zkab

Pls check post above ...

@zkab
ok. Easy go to NAT

Firewall >> NAT>>Port Forward

CONFIGURE YOUR NAT RULE...DO YOU KNOW HOW TO DO IT?

zkab

@silence Not sure how to do that ... looked at Firewall>>NAT>>POrt Forward

@zkab, use the example of the previous publication and then send a screenshot of how it turned out.

zkab

@silence I have Port=45007 in my system

zkab

@zkab Uppdated ...

zkab

Where do specify the incoming 'ssh login' IP-address?

@zkab Everything working?

Don't forget to click above if the answer helped you. please

@zkab en source addres
Display Advanced

zkab

@silence OK ... I will test it tomorrow when I have access to the computer ... Thanks for you support

johnpoz

@zkab I would suggest you test before then, say open it back up to any IP. Then go to can you see me . org and test to that port.. Do you get green, that is open?

If so then lock it back down to your source IP.

Users quite often forget about host firewalls, so I would test that your seeing open from the public internet before locking it down, etc.

@johnpoz said in External ssh login to LAN computer:

I would suggest you test before then, say open it back up to any IP. Then go to can you see me . org and test to that port.. Do you get green, that is open?

good idea.