next »

[thafener]

Hi @all

Want to reach a host in the LAN by VNC or Freenx but though I have created NAT rules
for both protocols I cannot connect.

LAN and FreeNX are both up on the target machine in the LAN, I can connect from the
LAN side of the pfsense box running on 1.3.2 Release

The NAT rule looks as follows :

IF        Proto   EXT. Port Range   NAT IP           INT Port Range
WAN -- TCP -- 22 (SSH)  --       192.168.1.2     22 (SSH)
                                             (ext.: any)

Unfortunately the tips from other posts did not help so any helpful tip is appreciated

Thanks in advance

hafnix

[EddieA]

I don't know about Freenx, but VNC uses port 5900 by default, not 22.

Cheers.

[thafener]

Thanks EddieA, I know about the VNC port and of course there is a similar NAT rule configured for VNC,
of course for port 5900

[clarknova]

Go to https://www.grc.com/x/portprobe=22 to find out if your port 22 is open to the outside world.

When creating your NAT entry, did you check the box at the bottom that automatically creates a firewall pass rule? If so, did you change the IP address or protocol in the NAT rule, or some other thing that would cause the NAT rule to be out of sync with the firewall rule?

[thafener]

Clarknova,

Thanks for the hint, checking port 22 on the link prorovided I get "stealth" as a result.
Yes I have checked the box that automatically creates the FW rule and I did not change
the protocols or IP adresses (see screenshot)

It confuses me that I can see SSH packets in the log (see screenshot) but I cannot
connect, what of course works fine from the LAN side.

Further tips anyone ?

thx hafnix

[Efonne]

If they aren't already, those firewall rules should be on WAN.  Also, this probably has nothing to do with it, but on the port forward you do not need to set the external address to any unless you have multiple WAN IP addresses and are trying to forward the port on all of them.

[thafener]

Yes Efonne, they are on WAN

[Efonne]

Do you have any firewall rules above those that might be blocking it?

[thafener]

No, just the ones created by the system and a rule to block Bittorrent 6969

[clarknova]

Your first screenshot looks as though pfsense has passed packets coming in on port 22. Very odd then that port 22 appears stealth from the outside world. Do you have a firewall running on your ssh host? Could it be that a host-based firewall is accepting packets from the LAN but not from outside addresses?

At this point I think tcpdump/wireshark/packet capture is in order to find out where the packets are stopping.

[thafener]

Hi again...

The SSH host is a Ubuntu 9.10 box with no firewall installed I am using to monitor
access points in this network. Connecting to this box from the LAN on Port 22 is
no problem at all...

Installed Wireshark on this box and let it listen for packets on Port 22 but there
was nothing so I think that though the log tells us the packets are passing they
are not going through.

I already thought about deleting all rules, make a backup of the box and re-install
the whole system from the scratch. Do you see any chance that this could help ?

Thx hafnix 

[clarknova]

If you're seeing packets arrive at pfsense's WAN, but nothing on the ssh host then they're dieing somewhere in between. There's a good chance your pfsense is misconfigured, or possibly even malfunctioning, and a fresh install could correct that, assuming you don't repeat whatever may have caused the problem in the first place.

[thafener]

Ok good I will try that somewhen soon. another proof for this Idea is the console log output :

Code:

Mar 12 15:01:44 gateway pf: 4. 327978 rule 102/0(match): pass in on ng0: (tos 0x0, ttl 118, id 55769, offset 0, flags [DF], proto TCP (6), length 48) 217.71.243.136.28170 > 192.168.1.2.22: S, cksum 0x3d8a (correct), 2222965890:2222965890(0) win 65535 <mss 1452,nop,nop,sackOK>

Next to this I have tried to reach the target system through a VNN tunnel and turned on logging, once
again the logs said Port 22 is going through but still I cannot reach the SSH host.

I do not know if there is a problem with the system in general, it is a Intel Atom 330 System on D945GCLF2 board using the onboard
Realtek NIC and a 3Com 3C905 NIC in the available PCI slot. Are there known problems with Atom boards or even these NIC's ?

Thanks a lot hafnix

[clarknova]

I believe both those NICs are fairly common in pfsense deployments. The realteks are known for low throughput/high cpu usage, but not necessarily flat out broken, that I'm aware of.

You could also do a packet capture on pfsense's LAN interface. If you have equipment between pfsense and Ubuntu this would help eliminate that as cause.

[thafener]

Packet Capture was a good plan. Starting a capture on the WAN interface showed packets on Port 22 but there
was no output on the LAN interface.
There is no equipment between the LAN interface and the target machine that could possibly block traffic.
Do you agree that this looks like a internal problem of the pfsense box ?