I’m trying to setup NAT on the OpenVPN tunnel, but I couldn’t get it to work.

NAT on LAN works normal.

 
I’ve setup a new interface incl. outbound NAT and named it WAN2.

WAN2 external, let’s take 2.2.2.2.

So, for testing, I tried with port 22 forwarding onto an internal device.

Connecting from external to 2.2.2.2 is not possible, so I thought, I could 
easly create a forwarding rule onto the WAN2, like I did it with WAN1, but port 
22 isn’t reachable and seems closed on 2.2.2.2.

Also http://www.canyouseeme.org/ <http://www.canyouseeme.org/> says, port is 
closed.

NAT rules are set, firewall also on the WAN2 tab.

 
Any suggestions?

 
$ cat /tmp/rules.debug

set optimization normal

set timeout { adaptive.start 0, adaptive.end 0 }

set limit states 22000

set limit src-nodes 22000

 
#System aliases

 
loopback = "{ lo0 }"

WAN1 = "{ vr1 }"

LAN = "{ vr0 }"

DMZ = "{ vr2 }"

WAN2 = "{ ovpnc1 }"

IPsec = "{ enc0 }"

OpenVPN = "{ openvpn }"

 
#SSH Lockout Table

table <sshlockout> persist

table <webConfiguratorlockout> persist

#Snort tables

table <snort2c>

table <virusprot>

table <bogons> persist file "/etc/bogons"

table <vpn_networks> { 10.0.8.0/24 }

table <negate_networks> { 10.0.8.0/24 }

 
# User Aliases

 
# Gateways

GWWANGW = " route-to ( vr1 172.16.0.1 ) "

GWWAN2_VPNV4 = " route-to ( ovpnc1 10.177.1.5 ) "

 
 
set loginterface vr0

 
set skip on pfsync0

 
scrub from any to <vpn_networks> max-mss 1400

scrub from <vpn_networks> to any max-mss 1400

scrub on $WAN1 all    fragment reassemble

scrub on $LAN all    fragment reassemble

scrub on $DMZ all    fragment reassemble

scrub on $WAN2 all    fragment reassemble

 
 
no nat proto carp

no rdr proto carp

nat-anchor "natearly/*"

nat-anchor "natrules/*"

 
 
# Outbound NAT rules (manual)

nat on $WAN1  from 127.0.0.0/8 to any port 500 -> 172.16.0.22/32  static-port

nat on $WAN2  from 127.0.0.0/8 to any port 500 -> 2.2.2.2/32  static-port

nat on $WAN1  from 127.0.0.0/8 to any -> 172.16.0.22/32 port 1024:65535

nat on $WAN2  from 127.0.0.0/8 to any -> 2.2.2.2/32 port 1024:65535

nat on $WAN1  from 10.0.0.0/24 to any port 500 -> 172.16.0.22/32  static-port

nat on $WAN2  from 10.0.0.0/24 to any port 500 -> 2.2.2.2/32  static-port

nat on $WAN1  from 10.0.0.0/24 to any -> 172.16.0.22/32 port 1024:65535

nat on $WAN2  from 10.0.0.0/24 to any -> 2.2.2.2/32 port 1024:65535

nat on $WAN1  from 19281.0/24 to any port 500 -> 172.16.0.22/32  static-port

nat on $WAN1  from 192.168.1.0/24 to any -> 172.16.0.22/32 port 1024:65535

 
# Load balancing anchor

rdr-anchor "relayd/*"

# TFTP proxy

rdr-anchor "tftp-proxy/*"

# NAT Inbound Redirects

rdr on vr1 proto tcp from any to 172.16.0.22 port 25 -> 10.0.0

                                                              rr on vr1 proto 
tcp from any to 172.16.0.22 port 443 -> 10.0.0.5

rdr on vr1 proto tcp from any to 172.16.0.22 port 80 -> 10.0.0.5

rdr on vr1 proto tcp from any to 172.16.0.22 port 143 -> 10.0.0.5

rdr on vr1 proto tcp from any to 172.16.0.22 port 236:237 -> 10.0.0.5

rdr on vr1 proto tcp from any to 172.16.0.22 port 465 -> 10.0.0.5

rdr on vr1 proto tcp from 5.45.103.97 to 172.16.0.22 port 822 -> 192.168.1.2 
port 22

rdr on vr1 proto tcp from 5.45.99.228 to 172.16.0.22 port 823 -> 192.168.1.3 
port 22

rdr on vr1 proto tcp from any to 172.16.0.22 port 993 -> 10.0.0.5

rdr on vr1 proto tcp from 37.120.163.136 to 172.16.0.22 port 4041 -> 
192.168.1.3 port 80

rdr on vr1 proto tcp from any to 172.16.0.22 port 8080 -> 10.0.0.5

rdr on vr1 proto tcp from any to 172.16.0.22 port 8333 -> 192.168.1.5

rdr on vr1 proto tcp from any to 172.16.0.22 port 8443 -> 10.0.0.5

rdr on ovpnc1 proto { tcp udp } from any to any port 28864:28865 -> 10.0.0.2

# Reflection redirect

rdr on { vr0 vr2 enc0 openvpn } proto { tcp udp } from any to 2.2.2.2/32 port 
28864:28865 -> 10.0.0.2

rdr on vr1 proto tcp from 37.120.163.136 to 172.16.0.22 port 4040 -> 10.0.0.8

# UPnPd rdr anchor

rdr-anchor "miniupnpd"

 
anchor "relayd/*"

anchor "openvpn/*"

anchor "ipsec/*"

# Allow IPv6 on loopback

pass in  quick on $loopback inet6 all tracker 1000000001 label "pass IPv6 
loopback"

pass out  quick on $loopback inet6 all tracker 1000000002 label "pass IPv6 
loopback"

# Block all IPv6

block in log quick inet6 all tracker 1000000003 label "Block all IPv6"

block out log quick inet6 all tracker 1000000004 label "Block all IPv6"

# block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a 
routing device,

# and clients "MUST NOT" send such packets to a router. FreeBSD won't route 
169.254./16, but

# route-to can override that, causing problems such as in redmine #2073

block in log quick from 169.254.0.0/16 to any tracker 1000000101 label "Block 
IPv4 link-local"

block in log quick from any to 169.254.0.0/16 tracker 1000000102 label "Block 
IPv4 link-local"

#---------------------------------------------------------------------------

# default deny rules

#---------------------------------------------------------------------------

block in log inet all tracker 1000000103 label "Default deny rule IPv4"

block out log inet all tracker 1000000104 label "Default deny rule IPv4"

block in log inet6 all tracker 1000000105 label "Default deny rule IPv6"

block out log inet6 all tracker 1000000106 label "Default deny rule IPv6"

 
# IPv6 ICMP is not auxilary, it is required for operation

# See man icmp6(4)

# 1    unreach         Destination unreachable

# 2    toobig          Packet too big

# 128  echoreq         Echo service request

# 129  echorep         Echo service reply

# 133  routersol       Router solicitation

# 134  routeradv       Router advertisement

# 135  neighbrsol      Neighbor solicitation

# 136  neighbradv      Neighbor advertisement

pass  quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} 
tracker 1000000107 keep state

 
# Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep)

pass out  quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type 
{129,133,134,135,136} tracker 1000000108 keep state

pass out  quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type 
{129,133,134,135,136} tracker 1000000109 keep state

pass in  quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type 
{128,133,134,135,136} tracker 1000000110 keep state

pass in  quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type 
{128,133,134,135,136} tracker 1000000111 keep state

pass in  quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type 
{128,133,134,135,136} tracker 1000000112 keep state

 
# We use the mighty pf, we cannot be fooled.

block log quick inet proto { tcp, udp } from any port = 0 to any tracker 
1000000113

block log quick inet proto { tcp, udp } from any to any port = 0 tracker 
1000000114

block log quick inet6 proto { tcp, udp } from any port = 0 to any tracker 
1000000115

block log quick inet6 proto { tcp, udp } from any to any port = 0 tracker 
1000000116

 
# Snort package

block log quick from <snort2c> to any tracker 1000000117 label "Block snort2c 
hosts"

block log quick from any to <snort2c> tracker 1000000118 label "Block snort2c 
hosts"

 
# SSH lockout

block in log quick proto tcp from <sshlockout> to (self) port 22 tracker 
1000000301 label "sshlockout"

 
# webConfigurator lockout

block in log quick proto tcp from <webConfiguratorlockout> to (self) port 443 
tracker 1000000351 label "webConfiguratorlockout"

block in log quick from <virusprot> to any tracker 1000000400 label "virusprot 
overload table"

antispoof log for $WAN1 tracker 10001570

# allow our DHCP client out to the WAN1

pass in  on $WAN1 proto udp from any port = 67 to any port = 68 tracker 
1000001591 label "allow dhcp client out WAN1"

pass out  on $WAN1 proto udp from any port = 68 to any port = 67 tracker 
1000001592 label "allow dhcp client out WAN1"

# Not installing DHCP server firewall rules for WAN1 which is configured for 
DHCP.

antispoof log for $LAN tracker 1000002620

# allow access to DHCP server on LAN

pass in  quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 
67 tracker 1000002641 label "allow access to DHCP server"

pass in  quick on $LAN proto udp from any port = 68 to 10.0.0.1 port = 67 
tracker 1000002642 label "allow access to DHCP server"

pass out  quick on $LAN proto udp from 10.0.0.1 port = 67 to any port = 68 
tracker 1000002643 label "allow access to DHCP server"

antispoof log for $DMZ tracker 1000003670

# allow access to DHCP server on DMZ

pass in  quick on $DMZ proto udp from any port = 68 to 255.255.255.255 port = 
67 tracker 1000003691 label "allow access to DHCP server"

pass in  quick on $DMZ proto udp from any port = 68 to 192.168.1.1 port = 67 
tracker 1000003692 label "allow access to DHCP server"

pass out  quick on $DMZ proto udp from 192.168.1.1 port = 67 to any port = 68 
tracker 1000003693 label "allow access to DHCP server"

antispoof log for $WAN2 tracker 1000004720

 
# loopback

pass in  on $loopback inet all tracker 1000006861 label "pass IPv4 loopback"

pass out  on $loopback inet all tracker 1000006862 label "pass IPv4 loopback"

pass in  on $loopback inet6 all tracker 1000006863 label "pass IPv6 loopback"

pass out  on $loopback inet6 all tracker 1000006864 label "pass IPv6 loopback"

# let out anything from the firewall host itself and decrypted IPsec traffic

pass out  inet all keep state allow-opts tracker 1000006865 label "let out 
anything IPv4 from firewall host itself"

pass out  inet6 all keep state allow-opts tracker 1000006866 label "let out 
anything IPv6 from firewall host itself"

pass out  route-to ( vr1 172.16.0.1 ) from 172.16.0.22 to !172.16.0.0/24 
tracker 1000006961 keep state allow-opts label "let out anything from firewall 
host itself"

pass out  route-to ( ovpnc1 10.177.1.5 ) from 2.2.2.2 to !2.2.2.2/32 tracker 
1000006962 keep state allow-opts label "let out anything from firewall host 
itself"

pass out  on $IPsec all tracker 1000007261 tracker 1000007262 keep state label 
"IPsec internal host to host"

# make sure the user cannot lock himself out of the webConfigurator or SSH

pass in  quick on vr0 proto tcp from any to (vr0) port { 443 80 22 } tracker 
1000007271 keep state label "anti-lockout rule"

 
# User-defined rules follow

 
anchor "userrules/*"

pass  in  quick  on $OpenVPN inet from 2.2.2.2 to any tracker 1426214069 keep 
state  label "USER_RULE"

pass  in  quick  on $OpenVPN  from any to any keep state  label "USER_RULE: 
OpenVPN  wizard"

# array key "pptp" does not exist for "" in array: {WAN1 LAN DMZ WAN2 IPsec 
OpenVPN } label "USER_RULE"

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 25 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 443 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 80 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 143 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 235 >< 238 
flags S/SA keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 465 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from 5.45.103.97 to 192.168.1.2 port 22 
flags S/SA keep state  label "USER_RULE: NAT MCBackup"

pass  in  quick  on $WAN1  proto tcp  from 5.45.99.228 to 192.168.1.3 port 22 
flags S/SA keep state  label "USER_RULE: NAT GitLab"

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 993 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from 37.120.163.136 to 192.168.1.3 port 
80 flags S/SA keep state  label "USER_RULE: NAT GitLab"

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 8080 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 192.168.1.5 port 8333 flags 
S/SA keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from any to 10.0.0.5 port 8443 flags S/SA 
keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto tcp  from 37.120.163.136 to 10.0.0.8 port 4040 
flags S/SA keep state  label "USER_RULE: NAT "

pass  in  quick  on $WAN1  proto udp  from any to 172.16.0.22 port 1194 keep 
state  label "USER_RULE: OpenVPN  wizard"

pass  in  quick  on $LAN  $GWWAN2_VPNV4 inet from 10.0.0.2 to !10.0.0.0/24 
tracker 1426209564 keep state  label "USER_RULE"

pass  in  quick  on $LAN  $GWWAN2_VPNV4 inet proto { tcp udp }  from 10.0.0.52 
to !10.0.0.0/24 port 80 tracker 1426433917 keep state  label "USER_RULE"

pass  in  quick  on $LAN  $GWWAN2_VPNV4 inet from 10.0.0.52 to 85.25.111.231 
tracker 1426356002 keep state  label "USER_RULE"

pass  in  quick  on $LAN  $GWWAN2_VPNV4 inet from 10.0.0.52 to 178.33.77.82 
tracker 1426425311 keep state  label "USER_RULE"

pass  in  quick  on $LAN inet from 10.0.0.0/24 to any tracker 0100000101 keep 
state  label "USER_RULE: Default allow LAN to any rule"

pass  in  quick  on $DMZ  $GWWANGW inet from any to !10.0.0.0/24 tracker 
1426231951 keep state  label "USER_RULE"

pass  in log  quick  on $WAN2 inet proto { tcp udp }  from any to 10.0.0.2 port 
28863 >< 28866 tracker 1426231596 keep state  label "USER_RULE: NAT Torrents"

 
# VPN Rules

 
anchor "tftp-proxy/*"

 
_______________________________________________
pfSense mailing list
https://lists.pfsense.org/mailman/listinfo/list
Support the project with Gold! https://pfsense.org/gold

Reply via email to