Port forwarding :: strange issue



  • Dear List Members

    I have a setup similar to the one below

    real IP                                    real IP
        x.y.10.0/24            –----------        x.y.20.0/24
          |------------------| x.y.10.100 |            |
          |                  ------------            |
          | IP x.y.10.10/24                            | IP x.y.20.2/24
          | GW x.y.10.1                                | GW x.y.20.1
      -----------                                -------------
    |  box a  |                              |  box b    |
      -----------                                -------------
          | IP 192.168.0.1                            | IP 192.168.0.2
          |                                            |
          |        NET: 192.168.0.0/24                |
      ---------------------------------------------------------
                |                  |                  |
                |                  |                  |
                |                  |                  |
                |IP 192.168.0.10  |IP 192.168.0.11  |IP 192.168.0.12
                |GW 192.168.0.1    |GW 192.168.0.1    |GW 192.168.0.2
          -----------        -------------      -------------
        |  box x  |      |  box y    |    |  box z    |
          -----------        -------------      -------------

    As you will notice, both box x and y have box a as default gateway, while box z has box b as default gateway.

    All configurations are done in box a

    I needed to route IPs to all three boxes, so I setup port forwarding under NAT in box A to forward ports to box x and y and z.

    box x and y providing http service, box z providing smtp service. Therefore, the associated rules are created accordingly. Any traffic coming to the external IP of box a is being translated accordingly for respective boxes depending on the services.

    When I try to connect to box x from outside, it works
    when I try to connect to box y from outside, it works
    when I try to connect to box z – it fails

    I have setup logging on the box a, and it appears to be translating properly, at least so does the log say with a green icon telling the packet has been passed. I tried capturing packets and it appears that packets have been translated accordingly but no response from the box z.

    However, if I am in any other box in the LAN then I can telnet to smtp port of box z. It does the transaction of email as well -- indicating that the box can exchange mail and is responsive to network boxes. However, when I try from outside (x.y.10.100), it does not work.

    even more strange, when I looked at the log it siad

    @39 pass in log quick on fxp0 reply-to (fxp0 x.y.10.1) inet proto tcp from any to 192.168.0.12 port = smtp flags S/SA keep state label "USER_RULE: NAT NAT inbound access for srvexchange01 smtp"

    The only different between boxes x, y and z is the GW of the boxes. I do not have access to this box and therefore cannot make any change to it. I have access to box a and boxes x and y though. I am not sure if that is what is making it not work and would therefore appreciate suggestions/pointers from all is highly appreciated.

    Thanks



  • Adding a bit more information for those who are looking

    I configured an additional IP on the WAN interface as (not all at the same time, of course  :P)
    a. Proxy ARP
    b. Other
    c. IP alias

    every time, after configuring the VIP, went to firewall > NAT > Port forward and added a rule from the new WAN IP to internal IP (0.12) in smtp port. restarted the box, check the settings once more, tried to telnet newIP smtp, Still no luck. I know 0.12 is responding to smtp request – I even did that from the shell of the box itself.

    I am running 2.0 beta5

    Thanks.



  • further to my previous test, I have managed to set up a different box with smtp enabled and tried to redirect the port to that box. When I had the box with a different GW, it did not work. Then I changed that box's GW to my pfsense box, and only once it worked. Rest of the times I am getting

    Escape character is '^]'.        
    SMTP synchronization error
    Connection closed by foreign host.

    this was done with IP-Alias VIP additional IP on the FW

    hmmmmm, makes me wonder . . .



  • Doing externally,,

    What happens when you do a simple ' telnet mymailserver.domain.net 25 ' ?
    Does an external client machine get connected this far?
    what mail server are you using?

    Also You do have a port forward for tcp 110 as well,correct?
    try telnetting port 110 as well and see what happens here–
    Post a couple screen shots of your port forwards and the coinciding LAN  & WAN rules as well.

    BC



  • Dear All

    In order to confirm my suspicion, I have configured four boxes in a test environment to emulate the setup below

    real IP                                    real IP
        x.y.10.0/24            –----------        x.y.20.0/24
          |------------------| x.y.10.100 |            |
          |                  ------------            |
          | IP x.y.10.10/24                            | IP x.y.20.2/24
          | GW x.y.10.1                                | GW x.y.20.1
      -----------                                -------------
    |  box a  |                              |  box b    |
      -----------                                -------------
          | IP 192.168.0.1                            | IP 192.168.0.2
          |                                            |
          |        NET: 192.168.0.0/24                |
      ---------------------------------------------------------
                |                                   
                |                                   
                |                                   
                |IP 192.168.0.10     
                |GW 192.168.0.?       
          -----------     
        |  box x  |     
          -----------

    In order to test, at the beginning the box X has the gateway 102.168.0.1, and portforwarding is setup on box A. Box X is running email (smtp) (and it works – I have tested it with another box on the LAN)

    As long as the GW is pointing back to box A, the setup works fine. I can communicate from box x.y.10.100 to box X, and the emails are delivered without any error.

    Changed the GW of box X to box B. It stopped working. No matter how much I tried (in many different ways including trying to force-route emails to that box) it DID NOT WORK. at one point I even waited for nearly half an hour hoping that the mail will route -- keeping an eye on the log which kept on complaining that box X is not responding).

    Changed back GW of box X to box A. It started working again. did not even have to touch anything on any of the boxes -- just waited five minutes and the email was delivered without even a hiccup.

    played the change back/to/back/to several times to confirm that this is the case.

    Personally, I am a little surprised since this is the first time I am encountering this (never needed port forwarding with pfsense before). i would have expected that no matter where the GW is, the box will always responding to the connection-initiating server. Otherwise, as per my first diagram, there is no way to maintain multiple GWs (redundant links) offering service from the same box -- I will be needing at least n=GW number of boxes to offer the services.

    I don't know if this is a bug or not (I am using V2 Dec2010 build). But if it is not a bug but something standard, can someone please confirm to that effect?

    Thanks to all for reading



  • shammins,

    with your gateway set to box b can you do a simple telnet from box b on port 25 to box x ( mail server)?
    you should try this to see if you are getting at least one way communication.

    If you can get a telnet connection try and do a telnet email send to your email server/ box x from box b and see how the email fails in this scenario.
    This will eliminate a few things to narrrow things down a bit.

    BC


Locked