0

Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server. Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.


After we made the "big switch", the pfSense interface was responding on https://84.1.1.1, this is not intended as we want to use https://84.1.1.1 (port 443) for our web server. For this reason i changed the pfSense port from 443 to 444 which "solved" this issue as port 443 is "free" for other services now.

We won't allow access to the pfSense interface from our external ip at all but that is another problem which is off topic.


Now i wan to forward port 443, 80 (and in future some more) to servers in our network. For this i first want to explain how i configured the WAN connection as i noticed something.

I tried to ping (with the pfSense ping diagnostic tool) from WAN1 (our WAN) to the web server. This did not work which means that my port forwarding also cant work at all. I think that pfSense tries to resolve this ping request via its gateway so i tried to set the gateway of WAN1 to none and from this moment on i can ping the webserver from WAN1 (via the pfSense ping diagnose tool).

Question: Do i need to set a Gateway to our WAN1? I suppose yes? And if yes, do i need to make some exclusions for internal network somewhere? Just as extra info, maybe its required, we have a static IP which directly hangs on pfSense...

pfSense configuration

WAN INTERFACE
    <wan>
        <if>igb0</if>
        <descr><![CDATA[WAN1]]></descr>
        <alias-address></alias-address>
        <alias-subnet>32</alias-subnet>
        <spoofmac></spoofmac>
        <enable></enable>
        <ipaddr>84.1.1.1</ipaddr>
        <subnet>30</subnet>
        <gateway>WAN1GW</gateway>
    </wan>

GATEWAY
    <gateways>
        <defaultgw4>WAN1GW</defaultgw4>
        <defaultgw6></defaultgw6>
        <gateway_item>
            <interface>wan</interface>
            <gateway>84.1.1.2</gateway>
            <name>WAN1GW</name>
            <weight>1</weight>
            <ipprotocol>inet</ipprotocol>
            <descr><![CDATA[WAN1 gateway]]></descr>
        </gateway_item>
    </gateways>

OUTBOUND NAT RULES
    <nat>
        <outbound>
            <mode>advanced</mode>
            <rule>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr><![CDATA[Auto created rule for ISAKMP - AXN_INTRA to WAN1]]></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <staticnatport></staticnatport>
                <disabled></disabled>
                <destination>
                    <any></any>
                </destination>
                <dstport>500</dstport>
                <created>
                    <time>1589543460</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
                <updated>
                    <time>1591883208</time>
                    <username><![CDATA[admin@10.128.10.29 (Local Database)]]></username>
                </updated>
            </rule>
            <rule>
                <interface>wan</interface>
                <source>
                    <network>10.128.11.0/24</network>
                </source>
                <dstport>500</dstport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <staticnatport></staticnatport>
                <descr><![CDATA[Auto created rule for ISAKMP - AXN_SRV to WAN1]]></descr>
                <created>
                    <time>1589888715</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
                <disabled></disabled>
            </rule>
            <rule>
                <source>
                    <network>10.128.20.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <updated>
                    <time>1590582795</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </updated>
                <created>
                    <time>1590582795</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </created>
            </rule>
            <rule>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <updated>
                    <time>1591883222</time>
                    <username><![CDATA[admin@10.128.10.29 (Local Database)]]></username>
                </updated>
                <created>
                    <time>1591883222</time>
                    <username><![CDATA[admin@10.128.10.29 (Local Database)]]></username>
                </created>
            </rule>
            <rule>
                <source>
                    <network>10.128.12.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr><![CDATA[Default NAT rule for axn_cloud]]></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <created>
                    <time>1589896652</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </created>
                <updated>
                    <time>1590140198</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </updated>
            </rule>
            <rule>
                <source>
                    <network>10.128.11.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr><![CDATA[Default NAT rule for axn_srv]]></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <created>
                    <time>1589888715</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
                <updated>
                    <time>1590140250</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </updated>
            </rule>
        </outbound>
    </nat>

About the forwarding itself, i configured it like this:

enter image description here as i set Filter rule association to Add associated filter rule during the creation of the Port forward, pfSense automatically created the corresponding/required firewall rule on the WAN1 port.

enter image description here

Question: Do i need some additional configurations to forward port 443 and 80 near the configuration i already did? (the port forward and creating the required firewall rules)

  • "I tried to ping (with the pfSense ping diagnostic tool) from WAN1 (our WAN) to the web server. This did not work which means that my port forwarding also cant work at all." Ping and web services really have nothing to do with each other. Ping uses ICMP, but web services use HTML on TCP. Those are completely different protocols. in fact, ICMP (ping) does not use or know about other transport protocols, such as TCP or UDP, nor does it know about the addresses (ports) those other protocols use. – Ron Maupin Jun 12 at 13:45
  • Thanks, i understand what you mean. How can this help solve my problem? Port 2xxx for our OpenVPN server can be forwarded without any issue. Clients can connect to the server which is "behind" pfSense – CodeNinja Jun 12 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.