Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Portforward 1 private ip to 2 different WAN

    Scheduled Pinned Locked Moved NAT
    12 Posts 4 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Are you talking about connections into each WAN going to the same internal host and port?

      Just make two port forwards.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • E
        ed123
        last edited by

        Yes, From 2 different WAN/ISP going to the same internal host and port. will i encounter some issues in doing this setup?

        Was ther any special settings for this one in port forwarding configurations or such?

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Two port forwards, with firewall rules (automatic) on each WAN.  The internal host doesn't care what outside IP the request came from. As far as I know pfSense and reply-to will keep everything straight on the way back.  Try it and see.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            So you want your ntp server (port 123 or was that just example?) open on 2 different wan IPs..  While it should work, not really understanding the reason why want/need to do something like that.  Why is 1 not enough for users on public internet to get too?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              If you have multi-WAN and it fails over and dyndns changes to your tier 2 you need a port forward there too.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                @ed123:

                will i face any issue if i use this kind of setup?

                Unless that port 123 was just an example: yeah, the main issue you will face soon will be a nifty DDoS amplification attack.

                1 Reply Last reply Reply Quote 0
                • E
                  ed123
                  last edited by

                  Thanks for inputs guys. another thing how can i secure the port forwarding in pf like on specific IP's or domain allowed to connect to it?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Source addresses on the WAN rules.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • E
                      ed123
                      last edited by

                      guys,

                      Now i tried the portforwading but it did not work. Please help

                      setup
                      No RDR (NOT) > uncheck
                      Interface > Wan
                      Protocol > tcp
                      Source > left blank
                      Destination > Wan adress
                      Destination port range > 80 to 82
                      Redirect target IP > 192.x.x.2
                      Redirect target port > http
                      Description > test
                      No XMLRPC Sync > ucheck
                      NAT reflection > USe system default
                      Filter rule association > Rule Nat test

                      Firewall Rules:
                      TCP  *    *  192.x.x.2    80-82  *  none

                      pf Version: 2.2.4-RELEASE (amd64) ..

                      I access it by publicip:81 or just publicip. I even change Destination from Wan address to Lan address but to no avail.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Access it from where?

                        Good list of things to check here:

                        https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.