Need to have Guest Network users (isolated) on same subnet access to only some LAN servers via port forwarding
-
Internet -> Netgate -> LAN1 -> Ubiquiti Amplifi Access Point (router in bridge mode) that has a Guest Network option enabled and also allows non-guest devices too.
LAN1 is the only LAN and is where the Guest Network is located. I cannot setup a LAN2 for the Guest Network due to ethernet and WiFi range limitations.
I run a few servers from my LAN that our accessible to the public internet by using port forwarding.
The problem:
Any device connected to the Guest Network cannot access any of the servers on the LAN unless the devices use a VPN to connect to some VPN server outside my network.I do not want to remove network isolation from the Guest Network, but instead force those devices out past the firewall and then re-enter through the port forwarding to the internal servers.
The Question:
Is there a way to configure the Netgate firewall to do this without need of using the VPN trick? So, allow all the Guest Network traffic to come back through the firewall via the port forwarding but continue to block all other Guest Network traffic to internal devices (isolation)? -
Oh, I need VLANs. Well, that would be easy if I had a managed switch. It's only money, which I'm short on currently.
-
Are you trying to access those servers using the public URL? If so you'd need NAT reflection enabled. Or split DNS.
https://docs.netgate.com/pfsense/en/latest/recipes/port-forwards-from-local-networks.html -
Though if the unifi device is blocking traffic between the guests and other lan clients you probably need NAT+Proxy mode in the reflection.
-
@stephenw10 I believe this is probably the case. Do you know where I can find information on the NAT+Proxy reflection setup?
-
Yeah you just need to select NAT+Proxy instead of Pure NAT as shown in that document I linked.
That sets NAT reflection for all port forwards which might be fine for your case here. However you can also choose to set reflection only on specific forwards instead. When using NAT+Proxy that can be a good idea since each instance you enable has to run a proxy process on the firewall.
Just for reference NAT+Proxy is generally not recommended but in your case it might be the only option to get past the guest isolation.
-
@stephenw10 said in Need to have Guest Network users (isolated) on same subnet access to only some LAN servers via port forwarding:
Just for reference NAT+Proxy is generally not recommended
It worked! So now, what are the concerns about using it. :-)
-
It adds a load on the firewall for each forward that uses it. That can be significant if you have a lot of users and/or traffic. Like thousands of connections perhaps. If you have recent hardware and not many users you probably won't notice.
It also hides the source IPs from the accessed servers which can make troubleshooting other issues more difficult and breaks client logging etc.
In almost every case it's not required and Pure NAT will work without proxying traffic but this is probably one of the exceptions.
-
@stephenw10 Ah perfect, that isn't a problem here. The problem however is the lack of UDP (TCP only), but this is a big step in the right direction.
-
Make sure the rules are passing it. By default a new firewall rule (or port forward) is set to TCP only.
-
@stephenw10 My mistake, I misread the limitations. Does appear to support TCP and UDP, so perfect!!
Thank you so much for your help!
-
@stephenw10 Well, it sort of works I'm learning. It works for a port forward to a Mumble server, that I was testing with you originally, but it is not working on the port forwards for my games servers that I added.
I went into Firewall->NAT and copied the Mumble entry that works and use it for the game server entries. The game servers are on a different IP addresses, so I changed those and the ports.
When I try to connect without a VPN, it doesn't connect.
However, when connecting with an active VPN to an outside server, I am able to reach the game servers just fine. So my port forwards are correct, but the NAT+Proxy isn't working like it did for the Mumble server.
Any ideas for the difference?
Also, I noticed there are setting for each NAT entry that controls the NAT+Proxy. How is this different than the System->Firewall NAT setting? (Global vs individual?)
Thanks
-
Yup global vs setting for each port forward. So you might try setting it to Pure NAT there. If so you would probably need to set
Enable automatic outbound NAT for Reflectionto prevent an asymmetric route.Check the states that are opened when you try to connect.
Do you see traffic arriving at the servers?
-
@stephenw10 Got it! I had some misconfigured firewall rules on the Ubuntu box itself.
Thanks for your patience and time. I'm learning and loving the move to netgate and pfsense from DD-WRT.
