Port forward source filtering
-
I have an internal Wireguard server running that forwards known hosts to an internal Nextcloud server. On pfSense I have a custom UDP port forwarded that sends matching traffic to the Wireguard server. In the pfSense settings I have source IP filtering set. This all works well with remote laptops, however mobile phones won’t connect unless source filtering is set to “All”. I suppose this is because cellular services are always changing IP addresses. Although, I can tether my laptop to my iPhone and use the cellular service to connect home without this issue (this part is weird).
Anyhow, I am wondering if this source filtering is a waste of time or if it might be worth trying to use some type of DDNS to give my mobile devices a consistent domain.
Many thanks!
-
@aljames said in Port forward source filtering:
I suppose this is because cellular services are always changing IP addresses.
Log the attempts and check if your filtering is working...
-
Thanks for the suggestion. I think my problem is the source IP that I had entered was the virtual interface (wg1) address of the remote host. I think this is supposed to be the physical IP of the remote host because the tunnel isn’t alive until access to the internal Wireguard server is physically possible. Mobile devices on cellular have dynamic IPs as far as I know, so not really possible to allow a device only that has a ever-changing IP. I wish there was a way to only allow a mobile device on cellular without setting allow “All” sources on the port forward.
I feel like I’m rambling. My apologies :)