Skip to main content
Super User

Return to Question

improved information on the issue
Source Link
Sim
Sim
  • 213
  • 5
  • 10

Somehow this does not work from the outside. From the inside (i.e., any of the defined nets) a ssh on the port works, but from the outside it times out. The tcpdump of the pflog shows that in both cases the port forwarding is triggered. A tpcdump on the corresponding interfaces confirmed that when the request is from one of the internal interfaces it is forwarded, when it is external it is not.What I know:

  • somehow this does not work from the outside as it times out
  • from the inside (i.e., any of the defined nets) a ssh on the port works * the tcpdump of the pflog shows that in both cases the port forwarding is triggered.
  • a tpcdump on the corresponding interfaces confirmed that when the request is from one of the internal interfaces it is forwarded, when it is external it is not.
  • when removing block all everything works. However, I do not want to drop this rule

Somehow this does not work from the outside. From the inside (i.e., any of the defined nets) a ssh on the port works, but from the outside it times out. The tcpdump of the pflog shows that in both cases the port forwarding is triggered. A tpcdump on the corresponding interfaces confirmed that when the request is from one of the internal interfaces it is forwarded, when it is external it is not.

What I know:

  • somehow this does not work from the outside as it times out
  • from the inside (i.e., any of the defined nets) a ssh on the port works * the tcpdump of the pflog shows that in both cases the port forwarding is triggered.
  • a tpcdump on the corresponding interfaces confirmed that when the request is from one of the internal interfaces it is forwarded, when it is external it is not.
  • when removing block all everything works. However, I do not want to drop this rule
added 162 characters in body
Source Link
Sim
Sim
  • 213
  • 5
  • 10

Somehow this does not work from the outside. From the inside (i.e., any of the defined nets) a ssh on the port works, but from the outside it times out. The tcpdump of the pflog shows that in both cases the port forwarding is triggered. A tpcdump on the corresponding interfaces confirmed that when the request is from one of the internal interfaces it is forwarded, when it is external it is not.

Somehow this does not work from the outside. From the inside (i.e., any of the defined nets) a ssh on the port works, but from the outside it times out. The tcpdump of the pflog shows that in both cases the port forwarding is triggered.

Somehow this does not work from the outside. From the inside (i.e., any of the defined nets) a ssh on the port works, but from the outside it times out. The tcpdump of the pflog shows that in both cases the port forwarding is triggered. A tpcdump on the corresponding interfaces confirmed that when the request is from one of the internal interfaces it is forwarded, when it is external it is not.

Source Link
Sim
Sim
  • 213
  • 5
  • 10

Port forwarding and NAT using pf on freebsd

I have a network router that connects three networks with the outside world. One of the internal networks is public facing the other two are not and connected via NAT. I am part of a larger network and the router has the ip 1.2.3.1 in that larger network, but this ip cannot connect to the outside and only traffic from external_net is allowed.

I now want to do port forwarding on the router ip to ssh on a machine in the nat. I am using pf on a freebsd.

My pf.conf is:

#define network macros                                                                                                                                                                                                                                                                                                        
uplink_iface = "igb4"
external_iface = "igb3"
l_iface = "igb5"
i_iface = "igb2"
d_iface = "igb1"
external_host = "1.2.3.1/32"

external_net = "1.2.4.0/25"
l_net = $l_iface:network
i_net = $i_iface:network
d_net = $d_iface:network

set skip on lo0

# tell the sender that they are running into pf                                                                                                                                                                                                                                                                               
set block-policy return
# do not keep states unnecessarily long                                                                                                                                                                                                                                                                                       
set optimization aggressive

#Nat config                                                                                                                                                                                                                                                                                                       
nat on $uplink_iface from $l_net to any -> $external_host
nat on $uplink_iface from $i_net to any -> $external_host
nat on $uplink_iface from $d_net to any -> $external_host


rdr pass log (all) on { $uplink_iface, $i_iface, $e_iface } proto tcp from any to $external_host port 6987 -> 192.168.2.2 port 22

#do not allow anything but the below rules                                                                                                                                                                                                                                                                                    
block all

# allow incoming traffic only to our external IP range/server                                                                                                                                                                                                                                                                 
pass from any to $external_net keep state

# allow any outgoing traffic from server and employee machines (tbd)                                                                                                                                                                                                                                                          
pass from { $d_net, $i_net, $l_net, $external_net } to any keep state

Somehow this does not work from the outside. From the inside (i.e., any of the defined nets) a ssh on the port works, but from the outside it times out. The tcpdump of the pflog shows that in both cases the port forwarding is triggered.

Why can't I connect via ssh from the outside but from the inside?