Nat & ssh problem

thafener

I have made a captore in full detail but could not find packets on port 22 for host 192.168.1.2 :-\

danswartz

Can you capture anything at all on the LAN side involving 192.168.1.2 or port 22 (e.g. two captures.)

thafener

I have scanned but only the capture for 192.168.1.2 produced output, sadly not for Port 22.
There is no traffic on port 22 coming through the box though it should according to the setup…

capture_host.txt

danswartz

If you try a connect (which hangs I assume, waiting for the SYN to be replied to), what shows up in the pfsense state table?

thafener

Yes there is something showing up in the state table, I was have used the host I am connecting from as a filter… see screenshot

statetable.jpg_thumb

danswartz

Hmmm, this is odd. Is it possible to do a capture on the ssh server itself? I am not sure I trust the capture on the pfsense.

thafener

Well I used wireshark on the target host running Ubuntu and there were no SSH packages from the Pfsense box to the target host.

danswartz

okay, thanks. boy, is that weird. question: i assume this doesn't work at all? if correct, does a reboot of the pfsense bring it back? also, do you have sshd enabled on the pfsense? if so, does disabling it "fix" this (i am not recommending that as a fix, just trying to isolate things.)

thafener

Yes man that's weird. Two weeks ago I had exactly the same problem and after doing everything from the book
and the troubleshooting guide I deleted all Firewall and NAT rules, made a backup without package info and reinstalled
the box from the scratch.
Then I reinstalled the packages (squid and lightsquid and the dashboard) and created the NAT rule for SSH first and
all others after and it has been working for a little more that a week.
I just noticed the high number of very similar NAT problems discussed in this Forum….really strange

thafener

Hi @ll

Here we go again, re-installed the whole box from the scratch, re-created the Nat rule as the only
existing one and I have exactly the same problems with the same outputs as before.
Tried NATting VNC (5900) too but no joy…. would any one of you guys give 2.0 a chance or
is there any other possible solution for this ?

Thx thafener

thafener

No clue anyone ? Might this problem be hardware-related ? I am running PF on a
Intel Atom 330 (D945GCLF2) using the onboard NIC (Realtek 8xxxx, might use much
memory but Ok…) and a 3Com 3C905C as the second NIC. Next to this the system
has 2 GByte RAM and a 160 GByte HDD.....

Found nothing problematic about this hardware combination in the compatibility lists
but maybe any one of you knows more....

spazio

Follow up:

It seem that the whole problem happend if captive portal is enable, basically the nat just doesnt work. It looks like the captive portal doesn't undestand or just block the nat.

If anybody found a solution or has details for nat with captive portal enable, please share?
Next step, will try with a dmz.

thafener

Spazio,

Thanks a lot for your reply… the cp is a hint, I did not consider having a look at this
side so far.
Does it mean you disabled the cp and it was working again ? Can you confirm this ?

However if you make a new install from the scratch it works again as it is the same
with a lot of PFSense issues from my side.
Some functions stop working without reason or without prior configuration changes
and it is impossible to find a logical reason.
However it is good for us that the functions of PFSense allow a fast install and restore
which can be done in some 20 minutes...

Thx thafener

spazio

yep, by disabling captive portal everything comes back to normal and nat is working again. Tried it with a new install without cp and it work.

For me the problem came from enabling captive portal.

This is a deal breaker still. There must be a way to have nat and cp enable and working at the same time

Efonnes

Is the system with the SSH server logged into the captive portal or configured in the pass-through MAC or allowed IPs of the captive portal? If not, it needs at least one of those. There is currently no way to selectively let certain traffic through the captive portal block on certain ports.

spazio

The ssh server is allowed in the pass tru mac. I also tried with a port 80 web server and it's the same. I can see the firewall let the packet tru in the log but it stop there.

thafener

Good morning

Exactly the same over here. The SSH server has a entry in the pass-through-list and well it
worked fine for a while until it stoppe working suddenly without prior changes in the
environment.
Like Spazio I can see the packets on Port 22 passing the firewall, but it seems they don't.

cheers thafener

thafener

Hi @ll

Done the following today :

Deleted all FW Rules from the problematic box and made a backup without package info.

Used the backup to set up a box with nearly the same hardware config (Atom 330 and
so on) and just with a Linksys NIC instead of a 3Com.

Re-created the NAT for SSH and it does not work no matter if the CP is enabled or not…

cheers Thafener

scorpii

Hi all,

I have the exact same problem with my psSense. Just thought I'd drop in and say that disabling CP solved the problem with NAT for me as well. Thanks Spazio for that hint.
And I agree that there must be a way to have both NAT and CP working at the same time. But in the end, right now I'd rather have NAT than CP…

My symptoms are the same. NAT seems to be working and the firewall log says that the traffic is let through. Using tcpdump on the WAN interface I can see the packages. Using tcpdump on the LAN interface, nada. Using Wireshark on the SSH-server host, no packages there either. But, disabling CP all is fine.

thafener

Hi @ll

I was able to reproduce this too meanwhile. I agree that both features should be working
at the same time as the CP is a really brilliant feature
Does anybody know if the developers are working on this ?

cheers thafener