Does PureNAT for Reflection in 2.2.1 even work?
-
I have a new and clean install with a port forward to an internal https (443) server. I am trying to access it internally via https://somename.dyndns.org
With NAT + proxy, it works. I was hoping the new Pure NAT would be more robust but I can't get it to work.
I have the following settings:
1. Enable (Pure NAT)
2. Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it originated from.I can't see what else I need to do to enable simple reflection. I'll be glad to help debug this some more if I get some pointers…
Thanks!
-
It is usually much simpler to use split DNS. On the pfSense DNS (forwarder or resolver) add Host Overrides for the host names concerned that point to the internal private IP addresses of the server/s. Then when you access externally you get the pfSense public IP that is already port-forwarded through to the server. When you access internally the name resolves to the internal private IP address and the client device goes directly to the server - no need for NAT reflection of any kind.
-
It gets much trickier if you are using a different external port like 123 which points to 321 internally. All the applications are set up for hostname:123 so even if I take care of the hostname part, how to easily "reflect" 123 to 321…
-
Yeah, that's easier if you put pfSense between the local clients and the server, meaning putting the server on OPT1 and the clients on LAN. You can then create a NAT entry that maps the destination port from 123 to 321 for connections to the server from LAN.
-
For this simple home network, I would like to keep the broadcast domain simple :)
I guess there is no answer to the original question?
-
If you set up your network to require port translation, it would be beneficial to set it up so you can port translate.
-
Well, like I said, home network. There are multiple web services so I need to offset ports: 80, 81, 82, 83 etc.
Still, is pure nat just broken???
-
Still, is pure nat just broken???
No, it works fine in general. Post your port forwards screen, and the output of: grep rdr /tmp/rules.debug
-
Here is the temp rules debug…
rdr on igb0 proto { tcp udp } from any to xx.222.4.232 port 3388 -> 192.168.10.2 port 3389 rdr on { vmx0 vmx1 } proto { tcp udp } from any to xx.222.4.232 port 3388 -> 192.168.10.2 port 3389 rdr on igb1 proto { tcp udp } from any to xx.207.23.137 port 3388 -> 192.168.10.2 port 3389 rdr on { vmx0 vmx1 } proto { tcp udp } from any to xx.207.23.137 port 3388 -> 192.168.10.2 port 3389 rdr on igb0 proto tcp from any to xx.222.4.232 port 57458 -> 192.168.10.2 rdr on { vmx0 vmx1 } proto tcp from any to xx.222.4.232 port 57458 -> 192.168.10.2 rdr on igb1 proto tcp from any to xx.207.23.137 port 57458 -> 192.168.10.2 rdr on { vmx0 vmx1 } proto tcp from any to xx.207.23.137 port 57458 -> 192.168.10.2 rdr on igb0 proto tcp from any to xx.222.4.232 port 443 -> 192.168.10.27 rdr on { vmx0 vmx1 } proto tcp from any to xx.222.4.232 port 443 -> 192.168.10.27 rdr on igb1 proto tcp from any to xx.207.23.137 port 443 -> 192.168.10.28 rdr on { vmx0 vmx1 } proto tcp from any to xx.207.23.137 port 443 -> 192.168.10.28 rdr on igb0 proto udp from any to xx.222.4.232 port 1194 -> 192.168.10.27 rdr on { vmx0 vmx1 } proto udp from any to xx.222.4.232 port 1194 -> 192.168.10.27 rdr on igb1 proto udp from any to xx.207.23.137 port 1194 -> 192.168.10.28 rdr on { vmx0 vmx1 } proto udp from any to xx.207.23.137 port 1194 -> 192.168.10.28 rdr on igb0 proto tcp from any to xx.222.4.232 port 8090 -> 192.168.10.249 port 80 rdr on { vmx0 vmx1 } proto tcp from any to xx.222.4.232 port 8090 -> 192.168.10.249 port 80 -
Those look sane. Are you redirecting it back out the same interface it came in on in this case? What do the resulting firewall states look like if you filter under Diag>States for something that should be reflected?
On an unrelated note, how'd you end up with igb and vmx NICs on the same system? Or is that combining from other systems?
-
These are the two states that try to make the connection:
LAN tcp 192.168.10.28:443 (98.207.23.137:443) <- 192.168.10.2:58131 CLOSED:SYN_SENT
WAN tcp 73.222.4.232:9604 (192.168.10.2:58131) -> 192.168.10.28:443 SYN_SENT:CLOSED -
These are the two states that try to make the connection:
LAN tcp 192.168.10.28:443 (xx.207.23.137:443) <- 192.168.10.2:58131 CLOSED:SYN_SENT
WAN tcp xx.222.4.232:9604 (192.168.10.2:58131) -> 192.168.10.28:443 SYN_SENT:CLOSEDLooks like a multi-wan issue? LAN is making a connection to WAN2 (xx.207.23.137) and the second line, WAN (xx.222.4.232) is making the reply?
The reason why I have igbX because my two WAN connections are PCI passthrough devices. VMX is my lan connection with is a 10G SFP+ connection to my lan switch.
-
My next guess was going to be the traffic hitting a firewall rule that forces it out to the gateway in question. Add a rule above any rule specifying a gateway or gateway group, matching destination of your local WAN IPs and internal LAN IPs, and try again. Suspect that'll work.
The reason why I have igbX because my two WAN connections are PCI passthrough devices. VMX is my lan connection with is a 10G SFP+ connection to my lan switch.
Ah ok, I was wondering if there was some new virtual NIC type I hadn't heard of, that makes sense now.
-
Right now, I can't find a rule that will match my packet so i'm at a complete lost as to what is going on. Maybe someone smarter than me could reproduce and debug this on their end…
-
Or you could post your rules.
-
Whatever interface the traffic is sourced on is where the rule(s) in question reside.
-
"VMX is my lan connection with is a 10G SFP+ connection to my lan switch."
Home network my ass ;)
Pretty highend home network.. But too cheap to buy more than 1 public IP? So your doing redirection via port?
-
Well, I just play with fancy gear (got the sg500x switch for too cheap!). I really don't know how one could set up a network with all these options you mentioned. I was looking into buying a domain name so I can configure all my https services with proper certificates but that's a daunting task right now. I just know simple network confit and nat reflection is what I know from cheap Linux routers.
-
you don't know how to buy a domain but you have a sg500x with 10g sfps? ;) And you like people having to put in urls like www.something.tld:1234 ? And then you redirect that again to :4567 on your private side?
So you have multiple hosts behind pfsense running all these different sites? Or just one – so you don't know about host headers and virtual domains, or how to serve up multiple sites off a httpd ?
So what speed of internet do you have that your hosting all these sites? To be honest there is little point to hosting anything off a "home" internet connection but if you need more than 1 IP so you don't have to use ports for host headers and virtual hosts in your httpd, etc. Then call your isp and tell them you need more IP addresses.
-
I know what you mean but i'm trying to port forward some security cameras. When I'm connected internally, the ip cam application points to xxx.dyndns.org:8081, 8082 and when i'm external to the network, they should just work. That is why I need reflection in my case.
