External ssh login to LAN computer

[zkab]

I have OpenVPN running on pfSense 2.5.4 where I have created users with certificates ... and it works OK.

Since there is an issues with one of my LAN Computer (IP 192.168.1.y) a service guy wants to 'ssh login' to (IP 192.168.1.y) from
an external computer (IP x.x.x).

How can I tell OpenVPN that only IP (x.x.x) can 'ssh login' to (IP 192.168.1.y) and that is the only access to my LAN ... they can't do anything else.

[viragomann]

@zkab
You need to configure a CSO for the client. VPN > OpenVPN > Client specific overrides.
So you can assign a specific IP to the client. State a high IP from the tunnel network.

Then you can use this IP in firewall rule on the OpenVPN tab to allow only the desired access.

[zkab]

Thanks ... still confused but at a higher level.
My knowledge in firewalls could be better ... trying to learn more.
Is there a documentation showing more in detail how to proceed?

[johnpoz]

@zkab said in External ssh login to LAN computer:

pfSense 2.5.4

Huh? Sure hope you didn't mean 2.4.5 you should update. But there is not 2.5.4

https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-multi-purpose.html#openvpn-client-specific-overrides

[zkab]

Sorry ... I have 'Version 2.5.2-RELEASE (amd64)'
I will check the link ...

[A Former User]

@zkab said in External ssh login to LAN computer:

can 'ssh login' to (IP 192.168.1.y) and that is the only access to my LAN

ok, i can help you let's go to your firewall rule and your openvpn configuration please.

[zkab]

Maybe I have mixed up things with OpenVPN.
Basically what I want is to 'ssh login' to a LAN computer 192.168.1.x from an external IP from Internet.
Is there away to set up a rule that allows the connection ... without involving OpenVPN.
Since ssh is running I have tested to 'ssh login' to my WAN address and it works OK.

[A Former User]

@silence post delete?

[zkab]

Pls check post above ...

[A Former User]

@zkab
ok. Easy go to NAT

Firewall >> NAT>>Port Forward

CONFIGURE YOUR NAT RULE...DO YOU KNOW HOW TO DO IT?

[zkab]

@silence Not sure how to do that ... looked at Firewall>>NAT>>POrt Forward

[A Former User]

@zkab, use the example of the previous publication and then send a screenshot of how it turned out.

[zkab]

@silence I have Port=45007 in my system

[zkab]

@zkab Uppdated ...

[zkab]

Where do specify the incoming 'ssh login' IP-address?

[A Former User]

@zkab Everything working?

Don't forget to click above if the answer helped you. please

[A Former User]

@zkab en source addres
Display Advanced

[zkab]

@silence OK ... I will test it tomorrow when I have access to the computer ... Thanks for you support

[johnpoz]

@zkab I would suggest you test before then, say open it back up to any IP. Then go to can you see me . org and test to that port.. Do you get green, that is open?

If so then lock it back down to your source IP.

Users quite often forget about host firewalls, so I would test that your seeing open from the public internet before locking it down, etc.

[A Former User]

@johnpoz said in External ssh login to LAN computer:

I would suggest you test before then, say open it back up to any IP. Then go to can you see me . org and test to that port.. Do you get green, that is open?

good idea.