Redirecting outcoming traffic

pedreter

HI!!

Please, is it possible via NAT to redirect outcoming traffic from a specific net to a group of internal servers to another very scpecific internal server ?????

Thanks in advance!

Pete.

viragomann

@pedreter
Are both, the source and the destination host within the same subnet?
If yes, than it would only work with masquerading in addition.

pedreter

Thanks @viragomann ,

sorry but i am not sure i am understing you corrrectly... the sending IP is from outside (Internet) and the destination is inside in my LAN...

Inside my lan the original destination is a server in a group of servers and i want to rerirect that traffic to a single one!

my undersating is that Masquerading is normally for outgoing traffic, but i need ir for incoming traffic...

Thanks again!

viragomann

@pedreter said in Redirecting outcoming traffic:

Inside my lan the original destination is a server in a group of servers

What does this mean?

If the source (client) is outside of your network I expect that it's original destination address is a WAN IP. From the WAN you can redirect the traffic to any host inside your network with a NAT port forwarding rule.
But also not clear, how you cover a group of servers. This would need a load balancer.

pedreter

Sorry viragomann, maybe ai did not explained it correctly, my fault! sorry...

I have a group of servers inside my LAN with balacing via DNS. When an external client wants to connect, via DNS the client gets a destination IP among those servers. What i want is that some specicifc client IPs always connect to the same server, despite the IP it got via DNS...

In a pseudo language it would be something like: all internet incoming traffic from IP net 20.20.20.0/24 going to any LAN address ---> change destination IP to 192.168.2.20

Thanks again!

Pet.

viragomann

@pedreter said in Redirecting outcoming traffic:

I have a group of servers inside my LAN with balacing via DNS. When an external client wants to connect, via DNS the client gets a destination IP among those servers.

So create a hosts alias and add all these IPs to it.

In a pseudo language it would be something like: all internet incoming traffic from IP net 20.20.20.0/24 going to any LAN address ---> change destination IP to 192.168.2.20

Again, from outside no one can use the any of your LAN IPs as destination. You may probably have multiple WAN addresses and forward these to some LAN IPs. So the outside client sends the request to one of the WAN IPs.

So then add a NAT port forwarding rule, set 20.20.20.0/24 as source and the server IPs alias as destination, state the destination port and enter 192.168.2.20 at redirect target and also the port.
Move this rule up above of the other port forwarding rule.

johnpoz

@pedreter said in Redirecting outcoming traffic:

via DNS the client gets a destination IP among those servers

Ok let me make sure understand what you want and what is going on..

So you have some dns say www.domain.tld that via round robin dns points to 3 different public IPs you have lets call them.

1.2.3.100
1.2.3.101
1.2.3.102

Now if they hit your pfsense via the .100 address they get sent to say 192.168.2.100, if they hit 1.2.3.101 they go to 192.168.2.101, etc.

So now what you want is no matter what public IP they hit 1.2.3.100,101 or 102 you want them to go to only 192.168.2.100 if they come from public IP range 20.20.20.0/24

Is this what your after and how your setup?

pedreter

Exactly @johnpoz

just antoher my mistake... internally IP is no 192.168.2.20 but 1.2.3.103 so ALL of them are valid public IPs... (192.168 again my typo, sorry)....

But yes, Johnpoz... this is EXATCLY what i need...

Thanks,

Pete.

johnpoz

@pedreter if the internal IPs are public, your not port forwarding.. So not sure how you would do it.. If you were port forwarding then you could do it.. But just routed with firewall rules to all.. Then no you couldn't redirect.. That would have to be done via say a view on your dns - which can be done pretty easy, depending on what dns your using?

pedreter

Thanks @johnpoz... i already considered a dns view but the dns queries may come from virtually anywhere, so.... :-(

johnpoz

@pedreter

I am curious as to why? If your balancing across 3 different machines, they all need to provide the same info... Why would you want/need to direct specific source IPs to a specific destination in your group?

If you proxied or forwarded the connections you could do it.. But if your just routing traffic to some public IP space behind you, sure you could create a firewall rule that blocks specific source from talking to x or y, and only allows to Z. But in a round robin dns, they would fail 2 out of 3 times, etc.

Not port forwards are evaluated before rules.. So it might be possible to create a port forward with source of your 20.20.20.0/24 to the specific machine. But you would need to setup 3 of them for your different destinations.. You might get by with an alias for that destination in your port forward..

Then the firewall is just the thing that allows it, but the port forward has already been done to that specific destination IP you want.

pedreter

thanks @johnpoz.

The purpose is to clasify traffic between importance levels... low importance traffic should go to different servers than important traffic.

viragomann

@johnpoz said in Redirecting outcoming traffic:

But just routed with firewall rules to all.. Then no you couldn't redirect..

I cannot think of any reason, why it should not be possible to redirect routed traffic to anything else.
If the traffic is routed to an interface of pfSense, you can. And I even do this, not on WAN indeed, but on other interfaces.

However, both directions, inbound and outbound, have to be routed through your firewall.

pedreter

@viragomann please, how do you do that? it may help me...

johnpoz

@pedreter Just create a port forward on your wan...

That sends traffic to whatever IP you want when the source is 20.20.20.0/24

The port forward would be used before the firewall that just allows traffic through.

viragomann

@pedreter
It's just a simple port forwarding.
But your set up is still not clear to me. We were talking about routed traffic. So I assume, it is routed to your WAN IP and your pfSense routes it to a public subnet behind. If so, port forwarding should be possible.

However, if the public network is bridged to the WAN it would not work. In this case the WAN address is part of the subnet and pfSense cannot route then.

johnpoz

@viragomann said in Redirecting outcoming traffic:

I cannot think of any reason, why it should not be possibl

It should be - but if your just routing there are no port forwards in the first place to manipulate.. He will have to just create port forwards even though not needed.

Still no idea why anyone would want/need to do such a thing in the first place.

viragomann

@johnpoz said in Redirecting outcoming traffic:

He will have to just create port forwards even though not needed.

As I said, it's still not clear to me, what he has exactly.

johnpoz

@viragomann in my example he said he has what I described, minus the port forwards.. Just firewall rules to allow the traffic.

But why would people from specific source IPs need to go to a specific server that clearly all do the same thing if you have a round robin dns setup..

If you want user X to only go to IP X, then create a new dns record x.domain.tld and tell them to use that.. Controlling it via source IP makes no sense..

viragomann

@johnpoz said in Redirecting outcoming traffic:

Just firewall rules to allow the traffic.

The only configuration I can think of, that would work with just firewall rules for public addresses is a bridge across pfSense. But in this case he cannot route and also not nat.