NAT reflection and port forwards broken in RC1
-
@heavy1metal:
I just never knew that it went through port forwards first, very good to know though.
I had always assumed it was the other way around but was recently informed of my ignorance! :P
When you know this it all makes more sense. :)
Steve
-
@heavy1metal:
I just never knew that it went through port forwards first, very good to know though.
I had always assumed it was the other way around but was recently informed of my ignorance! :P
When you know this it all makes more sense. :)
Steve
Well that's two of us, but yes it does make a whole lot of sense :-)
-
Seems to be a lot of confusion between firewall rules and Port Forward rules here.
External port must be any. Never does a server connect from his port 25 to 25….
That's clearly wrong. If that were true then you'd port forwarding packets arriving on WAN on ANY port to your internal SMTP server. ::)
The above quote is true for firewall rules though but the posted table is port forwarding.
Steve
Edit: It's correct that the source port won't be 25 but that's not relevant to port forwarding.
That's what I meant. On NAT you have a source port of <1023 and a destination port of 25. The rules then which are associated with the NAT rule cannot be altered. But if some mailserver on the internet wants to connect to pfSense certainly has NOT port 25 as his source port…
@Supermule did you try the connection from a different machine than the one the port is forwarded to? Also uncheck 'Disables the automatic creation of additional NAT...' under System->Advanced->Firewall/NAT...
-
Yes….both outside and inside the FW. Nothing is forwarded and NAT reflection is the same turned off or not.
-
Yes, but also from a different local machine? Then connect via ssh and do some tcpdumps…
eg. tcpdump -nvli LAN_INTERFACE port 25 and have a look if packages are coming in on LAN and out to your server... -
I dont know if you have got this resolved yet.
I am puzzled by an earlier statement that you made 'Nothing came through to the relevant servers behind. Every internal website was going to the login page of PFSense.' This lend me to think that one of your Port forward rules points at your WANIP,
I have 3 port forwards and all work from an internal machine, but I have multiple virtual ip's for this, but if I try to get to my wanip I do also get to the login page.
I did have to set nat relfection on the port forwards to enabled instead of system default.
let me know if I can help with anything.
-
I will see how it goes with the latest snaps. Been trying to figure a way to get the ARP entries to stay in 1.2.3 when using multiple LAN interfaces.
