0

I need to set a rule that allows me to connect BOTH from OUTSIDE the LAN (from the "internet" to the Internal server at IPv4 address 10.64.0.50 via port 22, by running ssh://1.2.3.4 -p 22; AND From within the LAN, say from Workstation LAN IPv4 address 10.64.0.10 to the same server.

enter image description here Given:

LAN 10.64.0.0/22
Workstation IPv4 address 10.64.0.10 (needs to connect to LAN server (10.64.0.50) via Internet WAN DNS IPv4 address
WAN Assigned IPv4 address (1.2.3.4)

So... I need to be able to go from: WS (LAN IPv4 address 10.64.0.10) SSH's to IPv4 address 1.2.3.4 / port 22 Request is sent to PFSense (WAN IPv4 address: 1.2.3.4 [PFSense]
[PFSense] translates / routes / NATs /Rules -- forwards to back inside LAN to--> 10.64.0.50 (port:122) (end destination server)

I've gotten the internet outside the LAN to the server to map... but can not get the inside the LAN to the LAN server to map, via the public DNS server WAN IPv4 address, through rules.

Any thoughts?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 19:57
1

I think you mean hairpin routing, which is a really, really bad idea because it wastes the bandwidth of your router LAN interface (in both directions), and it also adds a burden to your router resources (NAT translation is expensive, and the router spends time routing your internal traffic when it could be doing other things). Not all routers can do this. I believe pfSense calls it NAT reflection, and it is available on some versions.

The proper way to do this is to set up your internal DNS server to return the internal address of the server to which you are trying to connect (split DNS). Your traffic will remain on the LAN, never entering your router, and this is the way it is really meant to work.


Please do not use IP addresses belonging to another company (1.2.3.4 belongs to a different company). You may find that you lose Internet access (cut off by your ISP) when you do that.

  • Thanks, Ron! I knew there had to be a term for this sort of routing configuration. The split DNS is a perfect fix for the port 80 client to port 80 servers located within the LAN, however how would you best address the mapping of client port 22 to server port 122? An iptables rule on the server? I would like your thoughts on this, if you don't mind. ip 1.2.3.4 was just an example - you are correct - I should have used w.x.y.z or something generic. – T Brunelle Oct 30 '19 at 12:43
  • Unfortunately, host/server configurations, e.g. iptables, are off-topic here. You can ask about those on Server Fault for a business network. IANA has put aside three ranges of IPv4 addresses for examples: 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24. It also has a large prefix assigned for IPv6 examples: 2001:db8::/32. You should use those ranges if you do not mean for us to have the actual IP addresses. – Ron Maupin Nov 29 '19 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.