pfSense Gold Subscription

Author Topic: Unable to access a host on another subnet but can from pfSense [SOLVED]  (Read 550 times)

0 Members and 1 Guest are viewing this topic.

Offline lavito

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense
« Reply #15 on: November 08, 2017, 06:32:46 pm »
No joy, I am uploading details in case:
« Last Edit: November 08, 2017, 06:38:26 pm by lavito »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9098
  • Karma: +1037/-307
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense
« Reply #16 on: November 08, 2017, 07:00:13 pm »
Look at your source network. You need slimmer fingers.

And the NAT address should be the LAN2 interface address, not some /28 ffs.

How many APs are you trying to do this for? If one use a /32 destination address and LAN2 address as the NAT address.

That /29 source will only NAT if you are connecting from those specific hosts. Why are you using all these wacky netmasks?
« Last Edit: November 08, 2017, 07:04:49 pm by Derelict »
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline lavito

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense
« Reply #17 on: November 08, 2017, 08:06:38 pm »
It worked!!! Thank you very much!

As a note, I also had to make the port static for this to work.
The key point I was missing is that the "Translation\Other subnet" has to be the address of the destination interface.

The weird subnets was just desperation, to make things work.  ;D






Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1331/-194
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #18 on: November 09, 2017, 04:46:52 am »
"I also had to make the port static for this to work."

No you didn't..  Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9098
  • Karma: +1037/-307
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #19 on: November 10, 2017, 01:21:41 am »
Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.

Your NAT port should be 80, not any.

Glad it's working for you.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline lavito

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #20 on: November 10, 2017, 03:34:16 pm »
Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.

Your NAT port should be 80, not any.

Hmmmm,  :-\,  If I tick "Static", pfSence sets the NAT port to Any. However if I set NAT port to 80, then I cannot connect to 192.168.1.2:80 from 192.168.0.3 - I tried again.

Obviously you both know what you are talking about, why would this be?

"No you didn't..  Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..

As above, also I am not clear what you are saying, can you rephrase?
« Last Edit: November 10, 2017, 03:46:10 pm by lavito »

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1331/-194
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #21 on: November 10, 2017, 04:16:31 pm »
When a browser, or any application for that matter connects to pretty much any other application.. It is really rare that the source port needs to be something specific.. Some cases sure.. But very far and between.. http or port 80 have never seen such a case where the source port would have to be something specific.

When you set a static port on an outbound port forward what your saying is that pfsense can not change what the source port to something else.. So if your connection was from ipA:portX to ipB:80, then pfsense can not change that to ipA:portY to ipB:80..  Which is how Napt works.

Your pfsense lan2 IP is in your 192.168.1.1 right?  And your just trying to do a source nat to the web gui running on 80, because the device your connecting to on 80 does not have a gateway set..

Would look like below.  I just used my lan to show this like I was coming from a different network the 192.168.0.3 in your example.. And 192.168.1.2 is say on my lan..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline lavito

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #22 on: November 10, 2017, 04:40:05 pm »
Your pfsense lan2 IP is in your 192.168.1.1 right?  And your just trying to do a source nat to the web gui running on 80, because the device your connecting to on 80 does not have a gateway set..

Exactly!!! This is a WiFi router working as AP only. I am trying to access its Web Config pages.   

Would look like below.

I totally get what you are saying. Also, I did change the NAT port to 80 (non static), as you suggested,  so it can change  "ipA:portx" to " ipA:portY", however when I do this, I just cannot get trough to the AP's web interface.

I just cannot see how would the AP detect this and why your suggestion does not work.


When I change the NAT port to 80, I get following in the state log:

LAN1 tcp 192.168.0.3:52387 -> 192.168.1.2:80   CLOSED:SYN_SENT   
LAN2 tcp 192.168.0.3:52387 -> 192.168.1.2:80   SYN_SENT:CLOSED


When it is static I get below - Although I see the source port also changing, strange :

LAN1   tcp   192.168.0.3:52469 -> 192.168.1.2:80   ESTABLISHED:ESTABLISHED
LAN2      tcp   192.168.1.1:52469 (192.168.0.3:52469) -> 192.168.1.2:80   ESTABLISHED:ESTABLISHED

« Last Edit: November 10, 2017, 05:05:24 pm by lavito »

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1331/-194
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #23 on: November 11, 2017, 04:12:31 am »
Your post does not show a change in source port.. It's 52469 from the .0.3 box and when it gets forwarded from 1.1..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline lavito

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #24 on: November 11, 2017, 05:02:11 am »
Your post does not show a change in source port.. It's 52469 from the .0.3 box and when it gets forwarded from 1.1..

OK, get it (was late  :D).  Still don't get why non static does not work.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1331/-194
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #25 on: November 11, 2017, 05:29:54 am »
No idea... Sniff the traffic to see what you get back from the syn that is sent.. My guess is your getting RST back from the device because there is a session open or something.

Did you try rebooting the AP?
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9098
  • Karma: +1037/-307
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #26 on: November 11, 2017, 09:31:11 am »
Giving you some bunk info messing up between outbound NAT and port forwards. Sorry.

Set it like this:
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1331/-194
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #27 on: November 11, 2017, 09:55:15 am »
Good catch Derelict.. This is outbound nat you wouldn't set the NAT.. That would be done automatic.  You would do that with port forward inbound.  But shouldn't it work anyway? 
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9098
  • Karma: +1037/-307
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #28 on: November 11, 2017, 04:52:36 pm »
That was effectively static port. I would expect that to work intermittently at best.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline lavito

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
    • View Profile
Re: Unable to access a host on another subnet but can from pfSense [SOLVED]
« Reply #29 on: November 11, 2017, 05:22:40 pm »
Giving you some bunk info messing up between outbound NAT and port forwards. Sorry.

Great catch!

It now works ether way, when I set it as static or if I set it to any (non-static). I am now using (non-static)

Thank you!