Seeing pfSense Open Ports when Port Scanning Instead of Target Website
-
I'm sure there is a configuration I'm missing that is causing this to happen.
For context, everything else is working absolutely perfectly when normally browsing the internet and hosting websites behind pfSense.
So the scenario I'm testing at the moment is a bit of Port Scanning software against websites I own, some behind pfSense and others hosted elsewhere.
Yet every time I do this, I'm seeing the pfSense Open Ports in the entire pfSense firewall, not the Ports for the target website.
Setup;
- Internet
-
- www.external-website.com
- pfSense
-
- Computer
-
- Web Server
-
-
- Website www.internal-website.com
-
The Web Server is setup 1:1 NAT (only option due to the tech running)
pfSense is configured as Pure NAT (System > Advanced > Firewall & NAT > NAT Reflection mode for port forwards)
And I have DNS Resolver Enabled (strangely, when I turn this off, I then cannot access websites either on the Web Server or the Internet - Which I imagine is likely some caching issue somewhere along the way so that is probably a red herring - I'm pretty sure I don't actually use this service, it was probably something that got turned on at some point while testing).
What am I missing here?
Ultimately, all I want to happen is that from Computer, whenever I access either External Website, or Internal Website, that things just loop through the inefficient path so everything behaves correctly i.e. www.example.com --> Public DNS --> NS --> A --> IP --> etc.
-
@MichaelCropper You’re scanning from Computer, on LAN?
is reflection enabled on the 1:1 NAT ?
-
@MichaelCropper said:
So the scenario I'm testing at the moment is a bit of Port Scanning software against websites I own, some behind pfSense and others hosted elsewhere.
To start off: I suggest doing this sort of pen-testing from a host outside of your network (if not instead of, then at least in addition to). There's always a chance that a mis-configuration will not show up if testing from the LAN and could leave you vulnerable. Hosting things is no joke these days with extremely capable, cheap, automated tooling being used by attackers.
And I have DNS Resolver Enabled (strangely, when I turn this off, I then cannot access websites either on the Web Server or the Internet
Nope that's not strange at all! The DNS Resolver (Unbound) is probably THE most important service running on your pfSense. Without it, the firewall itself, nor any hosts it acts as a gateway for, can resolve any hostnames to IP addresses. So, typing in
claude.aiin your browser will get you this:
all I want to happen is that from Computer, whenever I access either External Website, or Internal Website, that things just loop through the inefficient path so everything behaves correctly
My suggestion: since you are lucky enough to have pfSense, is set up a VLAN/DMZ for your webserver, and create rules to selectively allow/forward traffic into that DMZ from the WAN and LAN (use Pure NAT mode). This way, your webserver will "see" the real IP addresses of visitors, instead of everything appearing to come from your WAN IP. And, you don't need hairpin NAT rules for every random port that your webapps might need exposed.
I do something very similar to this (also installed Traefik which made it a lot easier to manage the hostname/port routing).
-
Not sure when the annoying feature came into action on these forums that you can only edit an original post upto 60 minutes, but hey, that's annoying.
Here's the edited post I was trying to post - take this as the new baseline question with additional information (I'll follow up questions in a moment)
.....
I'm sure there is a configuration I'm missing that is causing this to happen.
For context, everything else is working absolutely perfectly when normally browsing the internet and hosting websites behind pfSense.
So the scenario I'm testing at the moment is a bit of Port Scanning software against websites I own, some behind pfSense and others hosted elsewhere.
Yet every time I do this, I'm seeing the pfSense Open Ports in the entire pfSense firewall, not the Ports for the target website.
Setup;
- Internet
-
- www.external-website.com
-
- www.external-port-scan.com = works correctly
- ISP
-
- IP 1.2.3.4 (1:1 Nat)
-
- IP 5.6.7.8 (Port Forward .)
- pfSense
-
- Computer
-
-
- Internal Port Scan = Defaults to pfSense Open Ports
-
-
- Web Server
-
-
- Website www.1-2-1-nat-internal-website.com
-
-
-
- Website www.port-forward-internal-website.com
-
The Web Server is setup 1:1 NAT (only option due to the tech running), on IP 1.2.3
pfSense is configured as Pure NAT (System > Advanced > Firewall & NAT > NAT Reflection mode for port forwards)
And I have DNS Resolver Enabled (strangely, when I turn this off, I then cannot access websites either on the Web Server or the Internet - Which I imagine is likely some caching issue somewhere along the way so that is probably a red herring - I'm pretty sure I don't actually use this service, it was probably something that got turned on at some point while testing).
What am I missing here?
Ultimately, all I want to happen is that from Computer, whenever I access either External Website, or Internal Website, that things just loop through the inefficient path so everything behaves correctly i.e. www.example.com --> Public DNS --> NS --> A --> IP --> etc.
-
Nat Reflection = Use System Default
(this is a really simplistic setup)
(PS Note to Mods..... : If anyone could give me 3+ "reputation points", whatever they are, so I can actually comment once more than every 2 minutes, that would be much appreciated given I've been a member of this forum for many years
Or the rules could be "revised" 
) -
Re. formal pen testing stuff. At the moment, this is merely a POC and was noticing a few strange behaviours that shouldn't be happening - as you highlighted, likely due to incorrect configurations.Re. DNS Resolver, given what you've said, that must have been active by default as I don't recall turning it on and configuring it. The screenshots you've provided certainly matches what I was experiencing (weirdly, except google.com which seemed to work as normal, even searching for things - Not quite sure why that worked when everything else didn't? Any thoughts? )
Re. VLAN/DMZ - Yeah, already set up, always good to reinforce that setup though
It's a bit more nuanced than that though in that we've a small handful of External IPs where we have different rules for different end points. Some require 1:1 NAT, others are fine with Port Forwarding ., I've updated the question in a comment just prior to a previous response to help reflect this better.
Re. "Seeing the Real IP Address" and "Pure NAT Mode"
I actually just turned "Pure Nat Mode" to "Disabled" and everything continued to work fine. But I am also aware of some things historically speaking that have required additional code (software layer, nothing to do with pfSense) that have required special workarounds to get the original IP of the HTTP Request , which I imagine is what you are referring to. Coming from a Software background, I imagine we're talking about two sides of the same coin here at different layers of the stack. Even stacks on AWS had this kind of workaround that was required, albeit it's all completely abstracted so one would have no idea what is really going on under the hood on platforms like that.
Re. "And, you don't need hairpin NAT rules for every random port that your webapps might need exposed"
And that is exactly what I'm trying to avoid, I would rather watch paint dry than be dealing with baby sitting the pfSense Firewall Rules. pfSense in this setup is merely a glorified signpost, it's not some janky enterprise setup that requires a department of people just to figure out why it's not behaving as it should be doing
-
Hmm....
Turns out the change in System > Advanced > Firewall & NAT
From;
Pure NATTo;
DisabledActually broke the Port Forwarding Stuff, but not the NAT 1:1 Stuff
No idea why, but that change has been reverted.
The breakage was only from the LAN side though, everything from the WAN side continued to work.
There is definitely a piece of knowledge missing from my understanding here.....
-
@MichaelCropper I've always found NAT reflection to be a hack that causes problems. Instead I would use split DNS, where you have host overrides that point your server's external FQDN to its LAN IP address instead of its public IP address. No need for NAT reflection as you're not doing any hairpinning.
-
@KOM said in Seeing pfSense Open Ports when Port Scanning Instead of Target Website:
found NAT reflection to be a hack
I would go as far as using the term abomination.. There is one answer to the question if your doing nat reflection, and that answer is your doing it wrong.
There are couple scenarios where you have to do it - which really are gun to your head scenarios. You have something on your lan that has hard coded dns pointing to ns outside.. Even thing I would just suggest dns interception..
Second the IP is hard coded in some app that points to the public side IP. Use a different app, get this one changed - hard coding of an IP is always wrong.
-
So just going back to the setup
- Computer - External User
- Internet
-
- www.external-website.com
-
- www.external-port-scan.com = works correctly
- ISP
-
- IP 1.2.3.4 (1:1 Nat)
-
- IP 5.6.7.8 (Port Forward .)
- pfSense
- - Computer - Internal User -
-
- Internal Port Scan = Defaults to pfSense Open Ports
-
-
- Web Server
-
-
- Website www.1-2-1-nat-internal-website.com
-
-
-
- Website www.port-forward-internal-website.com
-
What is the simplest way to get pfSense to just work the same for both Internal Users and External Users for doing port scans on websites either hosted internally or externally?
In an ideal world I don't want to be fiddling with the firewall for every domain and subdomain that is hosted as it feels like I'm duplicating efforts. The Domain's DNS stuff is already handled in the Public DNS system given they are publicly facing websites.
Feels like the changes I've been testing have been a bit like Whac-a-Mole where when I change one thing, it breaks another thing.
I'm still baffled why when I run a port scan on an External Website from a Computer on the LAN, I'm getting the pfSense Open Ports, instead of open ports on the External Website. That just makes no sense at all.
-
@MichaelCropper said in Seeing pfSense Open Ports when Port Scanning Instead of Target Website:
What is the simplest way to get pfSense to just work the same for both Internal Users and External Users for doing port scans on websites either hosted internally or externally?
Split DNS, but you chose to ignore that suggestion for some reason.
Feels like the changes I've been testing have been a bit like Whac-a-Mole where when I change one thing, it breaks another thing.
Welcome to NAT Reflection.
I'm still baffled why when I run a port scan on an External Website from a Computer on the LAN, I'm getting the pfSense Open Ports, instead of open ports on the External Website. That just makes no sense at all.
Agreed, which makes me think you're either doing something wrong or got confused about which server you're testing.
-
@MichaelCropper said in Seeing pfSense Open Ports when Port Scanning Instead of Target Website:
I'm getting the pfSense Open Ports
What do you mean by "pfSense open ports?" The pfSense web GUI? By default if you connect to the pfSense WAN IP from a PC on LAN, the LAN firewall rules allow connecting to "any."
-
Here's a visualisation to help with what I'm observing.
Green = Successful path
Red = Not working which I'm trying to figure out why (without using Split DNS)
Orange = Ports I'm seeing as Open no matter which of the 3x Websites I test against. When in reality, it's only the Orange bit which actually has those ports open (standard WHM/cPanel stuff). The ports I know are open on the other internal website is only 80 + 443. And when testing external websites, I'm still getting back the Orange Ports Open which is completely incorrect.
Hopefully that helps explain what I'm not all too keen on doing Split DNS, as it's just duplicate work - which in my mind, shouldn't be required.
What I'm observing from the Internal Computer is essentially me asking;
"What ports are open on Website X?" (and me expecting that to route through the same path that an External Computer would
But it's as though the routing is getting stuck and the question is getting translated to "Hey pfSense, what ports are open on the LAN that I can access?"
And the question is answered with Orange Open Ports, White Open Ports, + pfSense Web Admin Port
Hopefully that explains what is going on.
-
@MichaelCropper said in Seeing pfSense Open Ports when Port Scanning Instead of Target Website:
I'm not all too keen on doing Split DNS, as it's just duplicate work - which in my mind, shouldn't be required.
??? How many internal sites do you have that this would be a concern? Create your overrides once and they work forever, and you stop struggling with NAT.
-
@MichaelCropper said in Seeing pfSense Open Ports when Port Scanning Instead of Target Website:
Split DNS, as it's just duplicate work - which in my mind, shouldn't be required.
It is not duplicate - it is doing something correctly. You know what shouldn't be required all this wasting time trying to setup nat reflection.. Takes seconds to setup your local dns correctly. Vs bouncing traffic of your edge firewall/router for zero reason. Are my rules correct for external access, are my rules correct and work for a reflection.. etc...
-
@KOM I've just tested setting up Split DNS by adding a Host Override in the DNS Resolver for www.example.com which points to the Internal IP Address. And even when testing with PowerShell to check what ports are open using the command;
Test-NetConnection -ComputerName 192.168.x.x -Port 123When I'm testing with a Port that I know the VM on that IP Address doesn't have open, it's still showing as an Open Port which is strange.
Not sure what I'm doing wrong here and / or have something configured strangely?
-
@KOM So when I turn NAT Reflection from Pure NAT -> Disabled, and, I add in the Host Overrides for www.example.com etc. then that works as expected when accessing the websites in the web browser.
I'll just get that set up for the different sites, it's only a handful - and it only seems to be required for the Port Forwarded websites not he 1:1 NAT Ones so that's also a bit easier to manage. I do understand the Split DNS stuff is more efficient as it's routing things internally rather than going out and back in etc. In my head it's duplicate work as you are essentially managing two paths rather than just one, which in my experience tends to lead to drift and issues with the two routes being different.
Still the same odd behaviour when checking the Open Ports though.
-
@johnpoz So as a general rule of thumb, just always setup Split DNS stuff? Opposed to what I was originally thinking in that I shouldn't have to because things should just work the same regardless - but if NAT Reflection basically doesn't work properly, then I'll just ignore that in future and go down the Split DNS Route if that's the standard setup.
-
@MichaelCropper You're going client to client on the same lan so pfsense is not involved at all. Also, using the ip address kind of defeats the point of split dns. Third, udp/123 is used for ntp, and it's entirely possible that vm is running ntpd. Is this vm windows or linux?
-
@MichaelCropper said in Seeing pfSense Open Ports when Port Scanning Instead of Target Website:
Test-NetConnection -ComputerName 192.168.x.x -Port 123
If you are testing from a PC on the same 192.168.x.x subnet, that connection would not go through the gateway/pfSense. In that case the software firewall on the web server would govern what can connect from the 192.168.x.x network.
Privacy Policy · Cookie Policy