[SOLVED] Port forward

[HunorR]

Hello, im new in pfsense! i am trying to forward the port 21 from my NAS, and it works..  until i enter my username and password after that it doesn't do anything for 20 seconds only it shows me the error message that : make sure you have permission to access that folder. Details :  the operation timed out . what am i doing wrong ?

[HunorR]

ok, i have tested multiple port and none is working my setup is

internet ->  pfsense    - >        router                  - >      pc
                192.168.1.1          192.168.1.2              192.168.1.100             
                    (DHCP)          ( Disabled DHCP )        - >  laptop
                                                                              192.168.1.101
                                                                              - >    nas
                                                                              192.168.1.120

i wanted to forward 192.168.1.120:21 to port 21 , or just help me to forward any other port

[johnpoz]

Port 21, so the control channel of ftp then.

How are you accessing this – from something on 192.168.1.0/24 or actually outside your network?

Are you using active or passive ftp?  This also comes into play.

http://slacksite.com/other/ftp.html

I personally would not suggest you open ftp to the public internet - not unless your using really strong passwords.. Even then I would not suggest it.  Does your nas support sftp?  With public key auth?  Why not just vpn into your network and then access your nas file shares via whatever method you want.

[HunorR]

i have tried to setup pptp and i think it was working good only that i didn't have no internet access on the vpn, and i cant setup a dns(no-ip.org) for my pfsense for some reason. Well i did setup the dns but i can only access from inside my network not true the internet http://myserv.no-ip.biz/ this link should point at my router(pfsense)

[johnpoz]

Well that points too

;myserv.no-ip.biz.              IN      A

;; ANSWER SECTION:
myserv.no-ip.biz.      60      IN      A      5.15.47.144

Is that your public IP?  I show that in RO

inetnum:        5.15.0.0 - 5.15.255.255
netname:        RO-RESIDENTIAL
descr:          RCS & RDS Residential
descr:          City: Sibiu
country:        RO

role:          Romania Data Systems NOC
address:        71-75 Dr. Staicovici
address:        Bucharest / ROMANIA

As to accessing it from only inside - did you create the firewall rules to allow whatever it is you want to access, and forward ports to what you want to access?

" i didn't have no internet access on the vpn"

At a loss to what that is suppose to mean, so outside your network you vpn into your pfsense box..  And then you want internet access through that connection?  Then you need to setup pfsense to do that, etc.  But that is outside the scope of accessing your network vpn for access to your local resources.

[HunorR]

i have dinamic ip and i connected my ip to a free dns,  but my router is not communicating outside. And i wanted to have internet possibility on my vpn because my girlfriend is in china and alot of website is restricted for countries.The ftp port was used a lot of time and never head any problems.

[johnpoz]

What do you mean your router is not communicating outside?

I vpn into my pfsense from work almost every single day, and route internet traffic through it all the time.  You can either set your vpn connection to be set as the gateway.. In openvpn this is the checkbox called redirect gateway

"Force all client generated traffic through the tunnel. "

PPTP can be setup on the client to do this, etc.  But I would not use pptp to be honest.. It is deprecated and not considered secure, etc.

What do you have in front of pfsense?  Most likely a NAT router I would guess and pfsense is not getting a public IP on its wan/internet connection.

FTP is not secure, username and passwords are sent in clear text.. And I can tell you for fact that having ftp exposed to the internet will have lots and lots of brute force attempts against it, etc.  It is NOT secure..  But do what you want - I wouldn't suggest it though.  Unless this ftp server is just anonymous and open to the public, etc. to serve files.

Who needs to access these ftp files - you are users or random users on the internet?

The protocol is not very nat friendly, you have control channel and then data channel.  You have active and passive type connections that can connectivity through nats kind of a PITA.  Especially if both sides are natted, etc.

What I would suggest for your 2 different questions.. Is use openvpn to allow your GF to use your connection as internet connection, it can run on tcp or udp and if ran on say the ssl port 443 over tcp.  Its highly unlikely to be blocked.  It requires just the one port and is easier to connect to and setup behind a nat than PPTP which uses different protocols and ports..  And I would have to think the great firewall of china would filter pptp for sure..

I would also just leverage this vpn connection to access whatever resources you need to access on your own network, be via ftp, http, webdav, sftp, ftpes, smb/cifs, whatever while your outside your network or other users you want to access your network resources.

Another simple option is simple tunnels over ssh connections.  Your gf could use this as tunnel through her issues, as well could be used to access your resources on your network very easy.  Its a poor mans vpn ;)

Lots of ways to skin the cat, but ftp is antiquated and not secure - I would not suggest it.

[HunorR]

the pfsence is my gateway, it receives the ip from my internet providers true pppoe and i have dynamic ip Ii will try to setup openvpn but i seen that you have to install some additional programs to access the vpn ,and what rules i have to set up to have internet over the vpn?

[johnpoz]

Yes there is a openvpn client - just install the export package, makes it easy.

As to rules, you need to check the box that says redirect gateway.. Thats really all there is.  What firewall rules you setup to limit or allow access from the vpn clients into your network is up to your requirements.

[HunorR]

i have checkt the box for "Force all client generated traffic through the tunnel." and i tried to connect to my vpn … it connected but i didn't have any internet access so it means something gone wrong :(

[johnpoz]

And did you run the client as admin, you can not set routes on windows 7 without admin rights?

And your connecting to this from OUTSIDE pfsense?

[HunorR]

i started the VPN program as "Run as administrator" , but i didn't try it from outside only from inside that can be the problem? i'm going to send the program for a friend and i hope it works,i will be back with the results :)

[johnpoz]

if you want someone to test it that is actually literate in how this stuff works ;)  You could send me the configuration archive.  I don't need the software.  And just let me know any other resources you would like me to verify and or if just my internet goes through this connection, etc.

And I can show you the routing that makes it work, etc.

[HunorR]

ok where should i send you the file?

[johnpoz]

I will PM you my personal email.

BTW - they clearly did not run as admin, since you see the access denied on adding the routes.

Also your just running on UDP 1194, this is default – I can almost promise you this is NOT going to be open outbound from someone behind the China Firewall..  I would have your openvpn listen on tcp on a common port that is open, 443 or 80, etc.

Even then I would think that China is doing deep packet, and might be able to tell that its a openvpn connection.. Even though openvpn is ssl based vpn.  You can tell its not a typical handshake, etc.  You might need to hide the vpn traffic inside another ssl tunnel, etc.

But lets take baby steps and make sure your server actual works ;)

[johnpoz]

I got your email, but you only sent the ovpn file - and not the inline version that has the certs imbedded.  Please send the archive, ie ZIP file.. First download option in export client package tab.  This will include the certs needed to make the connection.

[johnpoz]

Ok I got in, but your not handing out any dns.. And seems your behind a double nat?

Here I connected just fine and get a route out

IPv4 Route Table

Active Routes:
Network Destination        Netmask          Gateway      Interface  Metric
          0.0.0.0        128.0.0.0      192.168.2.9    192.168.2.10    30

But you have a 128.0.0.0 mask??  huh?  Going to turn on logging and connect again ..

But I can trace out using you

C:>tracert -d 4.2.2.2

Tracing route to 4.2.2.2 over a maximum of 30 hops

1  154 ms  152 ms  152 ms  192.168.2.1
  2  155 ms  155 ms  154 ms  10.0.0.1
  3  154 ms  212 ms  155 ms  10.52.17.254
  4  154 ms  155 ms  156 ms  213.154.139.193

That 2.1 is you – but why do I hit 10.x.x.x addresses ?

And since I am on 192.168.1.0/24 as well - going to be a bit of a problem.. I would suggest you change your lan to oddball network, maybe 172.18.14.0/24 or something -- this is highly unlikely to match up with any outside networks connecting into yours.

edit.. Ok here is log attached, you can see I make connection just fine.. Have an issue with our overlapping networks so I would never be able to get to your local network.  If I had dns given out, 192.168.2.1 is pfsense and should work, but I can not get into your pfsense because of security check you have enabled. see other attachment

[HunorR]

so i should change my dhcp to 172.18.14.0/24 ? and i have nooo idea what is 10.0.0.1

[HunorR]

it shows me that 10.0.0.1 is the Gateway ….

How to disable the security check?

[johnpoz]

What do you have in front of pfsense? something is 10.0.0.1  – that is NOT a routable public address is a nat to rfc1918 from a public address.

I would change your local network, pfsense address and yes dhcp to be a different network other than common 192.168.1.0/24 -- I could change mine - but you most likely will run into this problem with other users, or other locations you come from.

If you check this, I should be able to get into your openvpn config and fix up some stuff. about dns, etc.  And look at your wan IP and see if your behind nat, etc.