• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Simple way to open up SSH port from LAN to DMZ

Scheduled Pinned Locked Moved Firewalling
36 Posts 5 Posters 1.2k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • P
    patient0 @rwillett
    last edited by Mar 27, 2025, 11:19 AM

    @rwillett please show the ssh -v output when you try to connect and doesn't work.
    Firewall rules-wise, it either works or not and if you check the rules, all with '0/0 B' in the 'States' column are never matched.

    R 1 Reply Last reply Mar 27, 2025, 1:55 PM Reply Quote 0
    • R
      rwillett @patient0
      last edited by Mar 27, 2025, 1:55 PM

      @patient0

      Hi I can't show the ssh output you as it now works.

      Looking at the tables again, the LAN rule I added is not activated as it has 0/0B

      d6c9a38c-2906-4f89-8188-85ac3319fe2f-image.png

      I have just disabled the rule I created earlier and it still works

      86e435b1-4ec7-4135-bfc2-34cb561850b7-image.png

      Nothing has changed on the NAT side.

      The only thing I noticed was that my Macbook Pro has two interfaces, a wired Ethernet and an wifi connection. The wifi connection was trying to connect to the hotspot on my mobile phone. The wired connection is static and stable. I've just changed the wifi to connect to my hotspot on the phone and the ssh connection still works, so its not that.

      I've not changed the ssh settings on the server in the DMZ, its not been rebooted, but clearly it works.

      I don't like this as I have no idea whats gone on its annoying but I can't get it back to not working, which is a funny position to be in.

      Grateful for your help here but I'm not sure I can break it the same way now.

      Thanks

      Rob

      T J 2 Replies Last reply Mar 29, 2025, 1:58 AM Reply Quote 0
      • T
        terryzb @rwillett
        last edited by Mar 29, 2025, 1:58 AM

        @rwillett
        Kill any existing states and try with MBP on WiFi?

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @rwillett
          last edited by johnpoz Mar 29, 2025, 2:47 AM Mar 29, 2025, 2:42 AM

          @rwillett you understand your first default lan rule allows any client on your lan to go anywhere you want - be that ssh, http, https etc.. doesn't matter if that something is out on the internet or on your local dmz segment. Wouldn't even matter if your dmz rules were empty or deny specific. Because the return traffic would be allowed by the state created when your default allow rule let it talk to your dmz host

          If your not allowed to get to your 192.168.2.20 box you either have a floating rule that is over riding your lan rule, or you mention something about two interfaces - you could have asymmetrical flow?

          More than likely if you can not talk to something on your dmz with the default lan rule your problem is the box your talking to host firewall, or lack of a gateway, or different gateway than pfsense dmz IP.

          I can talk to my ip cameras from my lan, no need for any return rules on the cam interface... My default lan rule allows anything on the lan to go anywhere - kind of what any means ;)

          state.jpg

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          R 1 Reply Last reply Mar 29, 2025, 1:17 PM Reply Quote 0
          • J
            JonathanLee @rwillett
            last edited by Mar 29, 2025, 6:52 AM

            @rwillett move your ssh rule to the top see if that helps…

            Make sure to upvote

            J 1 Reply Last reply Mar 29, 2025, 10:14 AM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @JonathanLee
              last edited by johnpoz Mar 29, 2025, 10:15 AM Mar 29, 2025, 10:14 AM

              @JonathanLee how would that help??? This rule allows everything!!

              rule.jpg

              His issue is not related to needing to allow 22 on lan to dmz or any rules on his dmz.. this rule allows ANY to ANYWHERE!! Which includes his DMZ...

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              J 1 Reply Last reply Mar 29, 2025, 3:17 PM Reply Quote 0
              • R
                rwillett @johnpoz
                last edited by Mar 29, 2025, 1:17 PM

                @johnpoz

                @rwillett you understand your first default lan rule allows any client on your lan to go anywhere you want - be that ssh, http, https etc.. doesn't matter if that something is out on the internet or on your local dmz segment. Wouldn't even matter if your dmz rules were empty or deny specific. Because the return traffic would be allowed by the state created when your default allow rule let it talk to your dmz host

                I do now , so I've removed that rule that I inserted so I am back to the default out of the box rules for the LAN and DMZ and it's working correctly.

                I do not know why it didn't work before and there may have been some weird behaviour from the wifi, the Macbook might have tried to connect to various hotspots on my various personal and wok phones, or the Ethernet. I misunderstood the default rule on the DMZ, I now know.

                I cannot create the issue that my ssh did not work. It works fine now. I think this is some weird networking from my Macbook due to wifi and the Ethernet doing something, but I don't know what. I;'m back to the out of the box rules and it now works. I'm happy with that and thanks very much for the help. I appreciate the time taken,.

                best wishes

                Rob

                J 1 Reply Last reply Mar 29, 2025, 1:23 PM Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator @rwillett
                  last edited by Mar 29, 2025, 1:23 PM

                  @rwillett said in Simple way to open up SSH port from LAN to DMZ:

                  Macbook due to wifi and the Ethernet doing something

                  is the macbook the client you were connecting from, or is the device that was in the dmz.

                  Is this wifi network a different network, other than your lan or dmz? Or is the wifi a guest network or something with isolation setup? Without more details can not tell you what was going on.

                  Glad you got it sorted.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  R 1 Reply Last reply Mar 29, 2025, 1:31 PM Reply Quote 0
                  • R
                    rwillett @johnpoz
                    last edited by Mar 29, 2025, 1:31 PM

                    @johnpoz

                    I was connecting from a Macbook to a newly created Linux server in the DMZ. I had checked that ssh was working on the Linux server, I did not try to connect from the DMZ to the LAN.

                    I have a wifi network running OpenWRT on the 192.168.1.x network, but nothing wifi related on the 192.168.2.x network. It now just has two low level Linux servers for work related activities. It only had one before and that’s been there for a long time even before the pfsense firewall. I had a Smoothwall there before.

                    I'm still trying to work out what was going on, but I'm coming to the conclusion that some networking on the Macbook was simply wrong and that I'm now back to the OOTB config and it just works. The rules I created were at the bottom of the list so it should have worked with the default settings, so even if I screwed the rule up, it wouldn;t have made any difference as the first rule should have matched.

                    I've never used a floating rules so thats not the issue.

                    I'll be honest and say I have no idea what went on, but its working now AND I udnerstand the default rule so I'm going to chalk it up to a bad day but its fixed.

                    Thank you all for your help
                    Rob

                    1 Reply Last reply Reply Quote 0
                    • J
                      JonathanLee @johnpoz
                      last edited by Mar 29, 2025, 3:17 PM

                      @johnpoz why does he have any ACLs if he has a any any rule ??? I didn’t even see that.

                      Make sure to upvote

                      J R 2 Replies Last reply Mar 29, 2025, 3:19 PM Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator @JonathanLee
                        last edited by Mar 29, 2025, 3:19 PM

                        @JonathanLee I have no clue to what you are talking about???

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        J 1 Reply Last reply Mar 29, 2025, 3:36 PM Reply Quote 0
                        • R
                          rwillett @JonathanLee
                          last edited by Mar 29, 2025, 3:29 PM

                          @JonathanLee

                          Assuming ACL is a pfsense ACL rather than Anterior Cruciate Ligament, the answer is "No".

                          Most of the pfsense setup is out of the box. Didn't even know pfsense did ACL's until now.

                          https://docs.netgate.com/tnsr/en/latest/acl/standard.html#standard-acl-example

                          I think the issue was with my Macbook, no idea what happened, but suspect it was a networking config on the client and the firewall was OK. I could connect to 192.168.1.1 (the pfsense firewall) from the Macbook, but it was the 192.168.2.x connection that was the issue.

                          Thanks

                          Rob

                          1 Reply Last reply Reply Quote 0
                          • J
                            JonathanLee @johnpoz
                            last edited by JonathanLee Mar 29, 2025, 3:41 PM Mar 29, 2025, 3:36 PM

                            @johnpoz This reply was related to the any any rule comment

                            Screenshot 2025-03-29 at 08.29.50.png

                            I did not see this before its any any rules so why have any rules at all it allows any thing and everything out.

                            Now that it is working try, working on making it more granular too so it is just not approving everything and anything.

                            Make it more specific to your needs. This is an example, I have time based rules, specific areas are blocked from being accessed. I have rules I enable when I need outbound vpn ports to the university. Some default blocks etc.

                            Screenshot 2025-03-29 at 08.35.05.png

                            pfsense can do so much why just leave it as approve everything.... At least set some time rules up. You lock a door when you leave right so why not lock a network when you leave or are not using it. I have time rules for my proxy see WPAD online or VPN access hours...

                            Screenshot 2025-03-29 at 08.39.54.png
                            Another example of use of time based restrictions. Especially if you have a vpn to access your network set up for like a private cloud or whatever it may be.. lock it down or hypothetically lock the door when you are not using it..

                            Make sure to upvote

                            1 Reply Last reply Reply Quote 0
                            • R
                              rwillett
                              last edited by Mar 29, 2025, 3:47 PM

                              Thanks for the information. I didn't set this rule up. This is what came out of the box.

                              3ef77590-ec83-4f8b-907b-a0550eb5f995-image.png

                              I'll read it through and see what I need. Since I work from home and have two teenage daughters, I tend to need the network 24/7 :)

                              Your point on being granular is well made and I've been lazy. I'll look at how to take as much access oput as I can.

                              Thanks

                              Ron

                              J J 2 Replies Last reply Mar 29, 2025, 3:55 PM Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator @rwillett
                                last edited by johnpoz Mar 29, 2025, 4:05 PM Mar 29, 2025, 3:55 PM

                                @rwillett said in Simple way to open up SSH port from LAN to DMZ:

                                I'll look at how to take as much access oput as I can.

                                Why - blocking outbound is going to do what but make your life harder... Please explain the logic in locking down your own trusted devices.. Other than work for you to do that will most likely only break shit..

                                If you want setup a rule above your any any rule to only allow http/https - and then below that a rule to block all logging... And watch where your stuff tries to go..

                                His rule there at the bottom - is pointless, the default deny already does that rule. I could see if he turned off default logging and set that rule to log.. But that rule is doing nothing the default deny doesn't already do - vs send back a reject vs just dropping the traffic.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                J 1 Reply Last reply Mar 29, 2025, 4:10 PM Reply Quote 1
                                • J
                                  JonathanLee @rwillett
                                  last edited by Mar 29, 2025, 4:07 PM

                                  @rwillett it is very complex to configure it like this, I only do this because I have a NAS and access to it across the full US, plus the work from home stuff so I have a secure side where I do not want even my own devices doing stuff I do not allow. I also have a lazy access point that is configured with any any stuff ...

                                  Not gonna lie... it does take forever to get it working right.

                                  Screenshot 2025-03-29 at 09.02.58.png

                                  This is my lazy ap for the kids and game stuff... I at least block access to the admin ports so nothing can get to the gui on that interface, I allow only the ap to talk with pfsense on the dns npt DHCP etc. and my any any rule allows anything out but no access to vpn or secure devices and it is all on a schedule.

                                  @johnpoz Yes my tinfoil hat fits perfectly....

                                  In all reality I am a computer science student with an AA in cyber security so most of my stuff was done to learn and make it as complicated as possible. In the end I am sure there is easier ways to do it. But I wanted my secure side to be proxied and certificate intercepted just like a super maze on that side.

                                  Long story short I have a lazy network too

                                  Make sure to upvote

                                  R J 2 Replies Last reply Mar 29, 2025, 4:09 PM Reply Quote 0
                                  • R
                                    rwillett @JonathanLee
                                    last edited by Mar 29, 2025, 4:09 PM

                                    @JonathanLee

                                    I'll leave it then.

                                    Rob

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator @JonathanLee
                                      last edited by johnpoz Mar 29, 2025, 4:10 PM Mar 29, 2025, 4:10 PM

                                      @JonathanLee most of those rules are pointless.. If you only allow proxy 3128, there is no specific reason to block to dns 443, since there is not rule that allow 443 any anywhere on those rules - the default deny again blocks that traffic.

                                      You do you - but in my 30+ years in the business, what the technical term for those set of rules would be is nonsense.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JonathanLee @johnpoz
                                        last edited by Mar 29, 2025, 4:10 PM

                                        @johnpoz yea start off with 443 and port 80

                                        Make sure to upvote

                                        J 1 Reply Last reply Mar 29, 2025, 4:13 PM Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator @JonathanLee
                                          last edited by johnpoz Mar 29, 2025, 4:21 PM Mar 29, 2025, 4:13 PM

                                          @JonathanLee this for example

                                          rules.jpg

                                          1 you block anything going to 80/443 - but then at 2 you also block traffic to dnsservers 443.. In what scenario would that traffic not already be blocked at rule 1.

                                          edit: another example of not understanding how the rules work..

                                          anotherexample.jpg

                                          You allow ntp to 192.168.1.1, which is fine - but no where in the rule set do you have an any any rule that would allow 123, so blocking it specifically is pointless..

                                          You know what a cluster of pointless rules do - they complex up trying to figure out what is actually going on.. So I would make a discussion point that if anything your making your network less secure - because clearly you do not understand how rules work at a basic level.. And you have what amounts to a bunch of noise in your rules you have to weed through any time your wanting to actually configure a valid rule, or troubleshoot why something isn't working.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          J 3 Replies Last reply Mar 29, 2025, 4:39 PM Reply Quote 0
                                          16 out of 36
                                          • First post
                                            16/36
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received