Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Outbound traffic from WAN couldn't access to web/mail server in NAT of LAN

    NAT
    7
    31
    9077
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jamesseen last edited by

      Dear masters…. please guide me to solve this problem. :'( Please refer following inllustration.

      User PC<--->Internet<--->WAN<--->pfSense<--->LAN(NAT) web/mail server

      my web/mail server is placed on LAN. What should i need to configure pfSense firewall so that user PC can access to web/mail server??

      Greats thanks to Masters....!!!!!

      1 Reply Last reply Reply Quote 0
      • H
        hoba last edited by

        You need a portforward (firewall>nat, portforward). It will create firewallrules automatically by default for the NAT-mappings you create. Depending on what your clients use to connect you will need smtp, pop3, imap and maybe a webmailport to be forwarded. If in doubt check your mailservers manual.

        1 Reply Last reply Reply Quote 0
        • J
          jamesseen last edited by

          Thank you for reply….

          I had done the NAT mapping which WAN direct to internal LAN port 80. It is a web server....

          Internet---->WAN---->LAN------>Webserver (e.g. www.bumiasia.com)

          :'( ::) :'( ??? ???

          1 Reply Last reply Reply Quote 0
          • J
            jamesseen last edited by

            I know it is a noob question. I really need a solution!  :'(

            The client machine from LAN is able to access the web server.(done the portforward on LAN interface) However, the client machine from outside Internet is not able to access the web server placed on LAN. (although I had done port forward on WAN interface)

            client–->Internet--->WAN---->pfsense----LAN NAT (web server)  ??? ??? ??? ???

            1 Reply Last reply Reply Quote 0
            • P
              Perry last edited by

              The more info you provide the more help you will get :)
              http://forum.pfsense.org/index.php/topic,7001.0.html

              /Perry
              doc.pfsense.org

              1 Reply Last reply Reply Quote 0
              • GruensFroeschli
                GruensFroeschli last edited by

                Could you provide a screenshot of your NAT and Firewall rules?

                (done the portforward on LAN interface)

                This is wrong. (ok maybe not wrong but unnecessary)
                You create portforwards on the WAN and if you need the forward from the inside to enable "NAT reflection"

                We do what we must, because we can.

                Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                1 Reply Last reply Reply Quote 0
                • J
                  jamesseen last edited by

                  ??? I wonder masters could understand what problem that I mentioned above…. sorry for my so poor english. hardly to express what i wanted to say. I would like to post my network layout. please refer....


                  1 Reply Last reply Reply Quote 0
                  • J
                    jamesseen last edited by

                    What i had achieved from the above network layout (forum.jpg) were the PC (xp machine) within LAN was able to access web hosting (using port forwarding NAT to achieve this although there was an another xyz firewall connected to same network 192.200.9.0 LAN ) and web mail and could access Internet.

                    1 Reply Last reply Reply Quote 0
                    • J
                      jamesseen last edited by

                      Now, the problem I'm facing now assume there is an user PC (XP machine) would like to access to my WebHosting by typing URL from Internet Explorer browser "http://www.bumiasia.com" and that user PC was unable to access it. I had made the port forward on WAN interface as external to NAT IP of my DNS server. Please view my screenshot of it. many thanks!!!

                      ![WAN to NAT DNS.JPG](/public/imported_attachments/1/WAN to NAT DNS.JPG)
                      ![WAN to NAT DNS.JPG_thumb](/public/imported_attachments/1/WAN to NAT DNS.JPG_thumb)

                      1 Reply Last reply Reply Quote 0
                      • GruensFroeschli
                        GruensFroeschli last edited by

                        Enable NAT reflection.
                        (advanced)

                        We do what we must, because we can.

                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                        1 Reply Last reply Reply Quote 0
                        • J
                          jamesseen last edited by

                          Sir, Enabled NAT reflection also couldn't solve it. The remote user still unable to access the server behind pfSense…. ??? ??? Why is it?? Still there any setting i missed out???  :o

                          1 Reply Last reply Reply Quote 0
                          • C
                            cruzades last edited by

                            have you checked your HTTP port yet?

                            try to check it using "grc port scanner".

                            1 Reply Last reply Reply Quote 0
                            • J
                              jamesseen last edited by

                              :'( :'( :'( ??? ??? ???

                              The PC from WAN still couldn't access to that web server that sitting behind pfSense…. Someone please guide me..... I had logged the packets that PC from WAN might had be passed through pfSense, but somehow  don't know why that remote PC from WAN couldn't access to the webserver. my server port is 8888. Please help me refer the picture below. Thank you very much!!!


                              1 Reply Last reply Reply Quote 0
                              • J
                                jamesseen last edited by

                                According to nmap scanned on pfsense itself, I noticed the pfSense firewall had not open 8888 port yet, am i correct? Please look at the nmap scan report below.

                                Interesting ports on pfsense.local (192.200.9.7):
                                Not shown: 1694 filtered ports
                                PORT  STATE SERVICE
                                22/tcp open  ssh
                                53/tcp open  domain
                                80/tcp open  http

                                Nmap finished: 1 IP address (1 host up) scanned in 30.299 seconds

                                1 Reply Last reply Reply Quote 0
                                • C
                                  cruzades last edited by

                                  likewise here, i have problem opening my ports 6112-6119, but somewhere in this forum someone suggested to use "Outbound" option at NAT, and click "Manual.. (advance..) and click SAVE, pfsense will generate a list of entry, click Apply.

                                  in my case, viola, it opens my ports after this.

                                  HTH
                                  -cruzades

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jamesseen last edited by

                                    I'd done what you instructed, enable manual…(advance).... yet, still remote pc couldn't access and the port 888 is not opened.

                                    no luck at all ??? >:(

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jamesseen last edited by

                                      zzzz…... no one could answer me.... :'(

                                      I think the problem might be XYZ firewall attached to the LAN. The XYZ firewall had blocked the traffic that tried to access web server:888.

                                      What do you guys (masters ) say??


                                      1 Reply Last reply Reply Quote 0
                                      • GruensFroeschli
                                        GruensFroeschli last edited by

                                        Your clients/server behind pfSense dont happen to have as default gateway this other firewall, do they?
                                        (What is it doing there anyway?)

                                        We do what we must, because we can.

                                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jamesseen last edited by

                                          Actually, XYZ firewall is currently in use and I wanted to replace it with pfSense in future due to XZY has limited features provided and one day XYZ firewall will be removed…..

                                          I'm sorry, I can't get you. Are you asking the Client/Server do not have default gateway of pfSense instead of XYZ firewall as their default gateway. Is that what u were saying? Hhmmm...I'll check it. :o Thank you!!

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            maaraujo last edited by

                                            In your diagram I see you have a private IP on your WAN interface and a public IP on your LAN. Did you configure your network in this way for a particular reason?.

                                            If so, how is Interfaces/WAN/Block Private Networks set?.

                                            Saludos.

                                            Miguel Ángel Araujo
                                            México

                                            1 Reply Last reply Reply Quote 0
                                            • J
                                              jamesseen last edited by

                                              Dear maaraojo, by default, Interfaces/WAN/Block Private Network was checked…. Does it block traffic from WAN to LAN? I hope it is not.

                                              Hmm, I checked those servers. It is indeed those servers default gateway were not set to pfSense Box. Should I need to set their default gateway to pfSense box? I heard one of my friend said that it is not necessary must set those servers default gateway to pfSense box. He said install a proxy server on pfSense box would solve those default gateway. What he said was correct???? Need advice..... ??? ???

                                              1 Reply Last reply Reply Quote 0
                                              • M
                                                maaraujo last edited by

                                                jamesseen,

                                                I couldn't resolve www.bumiasia.com. How are you testing?.

                                                Saludos.

                                                1 Reply Last reply Reply Quote 0
                                                • J
                                                  jamesseen last edited by

                                                  Thank you, maaraujo….

                                                  Unfortunately, at moment I still don't have "authority" to modify any setting on the Server. I have to wait me superior officer to do those setting on server.(add default gateway to pfSense box instead of XYZ firewall)

                                                  I'll let u guys to know the latest update soon....

                                                  1 Reply Last reply Reply Quote 0
                                                  • J
                                                    jamesseen last edited by

                                                    Dear GuRUs…. one question, if I set default gateway to pfSense firewall, all of the traffic response would be going to pfSense box which is not suitable. I would like to ask is it possible to implement WAN traffic packet from pfSense box toward web/mail server will reply back to pfSense and WAN trafic packet from XYZ firewall toward web/mail server reply back to XYZ firewall???? Please refer again for the below network diagram.
                                                    For Your Information, XYZ has reverse proxy....

                                                    Thank you so much!!!! ::)


                                                    1 Reply Last reply Reply Quote 0
                                                    • H
                                                      hoba last edited by

                                                      Not really possible. Sorry.

                                                      1 Reply Last reply Reply Quote 0
                                                      • S
                                                        sopont last edited by

                                                        Hi, friend,,,,

                                                        1. check your ADSL Router pass all port to pfSense WAN interface.
                                                        2. pfsense ports forward are 80, 143, 25, 110 for web and mail server.
                                                        3.all your server default to pfSense LAN interface.

                                                        good luck..

                                                        1 Reply Last reply Reply Quote 0
                                                        • J
                                                          jamesseen last edited by

                                                          @Sopon:

                                                          Hi, friend,,,,

                                                          1. check your ADSL Router pass all port to pfSense WAN interface.
                                                          2. pfsense ports forward are 80, 143, 25, 110 for web and mail server.
                                                          3.all your server default to pfSense LAN interface.

                                                          good luck..

                                                          @hoba:

                                                          Not really possible. Sorry.

                                                          Thank you for your reply….
                                                          Can I set 3 default gateways on my servers toward pfSense firewall boxes?? Please refer below network diagram...


                                                          1 Reply Last reply Reply Quote 0
                                                          • S
                                                            sopont last edited by

                                                            i think can set to 3 gateways or more, but it defference VLAN and subnet on your servers and then easy subnet pointing to easy gateway. why not you optimized to single pfsense firewall have 1 wan (default), 2 OPT1, and 1 LAN?, and using balancing feature or policy routing for outgoing, and multi homing for incomming.

                                                            1 Reply Last reply Reply Quote 0
                                                            • J
                                                              jamesseen last edited by

                                                              Dear Gurus, due to the servers behind the pfSense box couldn't set a default gateway to 192.200.9.7, I would like to implement a reverse proxy after pfSense box so that remote users from WAN maybe (hopefully)can access to servers without set a default gateway on those servers. What would you think? Is it possible?? Please refer following network diagram. Thanks!!!


                                                              1 Reply Last reply Reply Quote 0
                                                              • S
                                                                sopont last edited by

                                                                i think you can set server default gateway to 192.200.9.7, but i don't know what devices is "reverse proxy ".
                                                                i see your diagram "reverse proxy ", is basic proxy server with bridge function right?. if yes, can your files server ping 192.200.9.7?. if can, you can set to that. if your server can't ping to 192.200.9.7 please resolve packet filter or routing on your "reverse proxy ".

                                                                good luck

                                                                1 Reply Last reply Reply Quote 0
                                                                • J
                                                                  jamesseen last edited by

                                                                  Unfortunately, those servers behind pfSense Box are not able to set default gateway of 192.200.9.7. Due to this problem, I'm planning implement a Reverse Proxy (Pound) after pfSense box. From my noob understanding, with reverse proxy attached to the network, default gateway(192.200.9.7) is not required to be set on those servers…. am I rite??? ??? ??? Thanks for feedback...!!

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • First post
                                                                    Last post