Allow only specified set of IPs to use external port on pfSense

Question

I have a pfsense router and a NAT rule that allows a port redirect.

| GitHub | - ( Internet ) - [pfsense] -net port translation- [ Jenkins ]

I want gitHub to be able to reach my jenkins, but no other ips. I noticed that I can set restrict inbound ports to a network, but that will not work as I need 3 networks to be enabled. Can i enable 3 networks for allowed external IPs for a specific NAT rule?

Github's meta has this

 "hooks": [
    "192.30.252.0/22",
    "185.199.108.0/22",
    "140.82.112.0/20"
  ],

So I need to enable 3 networks, but I'm not sure how.

Here is the pfsense UI that I used to add one network:

I'm not sure how I can enable the other two networks.

Answer 1

When you use the advanced button, it creates a rule. You can see it by going to Firewall > Rules.

To solve the problem you can use this information as a guide. Here are the steps:

1. First set the Advanced option to one network that you want to enable, create the NAT rule.

2. Then go to Firewall > Rules, and duplicate that rule as many times as you need. I needed to duplicate it 3 times, since I needed 3 networks. After you duplicate it, change the network setting to be one that you need, here is one example.

Here is what the rules look like:

That worked! If you are a bit crazy like me, you will be unhappy that one rule is managed by the NAT rule and two are not managed by the NAT rule, I don't know of a way to fix that. The two new rules that are created using the duplicate are independent of the NAT rule, so for instance, if you delete or disable the NAT rule, the firewall rule would normally also go away. But since they are created independently they do not go away. The only think I could do was name them the same so it's clear they are releated.