I am trying to use opnsense to create a lab environment.
The topology is this:
LABLAN (192.168.252.0/22) <--> WANLAN (192.168.1.97) <--> REALWAN (public internet).
So, this is a lab network that is inside our office network, where the lab network's "WAN" address is a private IP address on our LAN.
This works, and the machines on the LABLAN can access the internet (Example path: 192.168.252.100 -> 192.168.252.1 -> 192.168.1.97 -> 192.168.1.1 -> public internet
Here's my problem:
I want to be able to manage the firewall from the office LAN (192.168.1.100), which means I have to access the OpnSense firewall on 192.168.1.97.
To do this, I took the following steps:
- Turned off "block private networks"
Turned off bogon networks (not really related, but I did do this).[/li]
[li]Changed the management port to 8443[/li][/list]
Created a NAT rule to forward TCP with a destination of 8443 on the WAN address to the LAN address for the firewall at the same port
[/list]
This does not work. Firewall logs show that the traffic was allowed (I see a "pass" entry with the source IP of my workstation and a destination IP of the WAN), but I cannot access the gui.
This works with pfSense, tomato firmware, and other firewalls I have used. But, it seems I have missed a step here.
Does anyone know how to make this work?
I figured it out. Doing a dump with pfctl -sr | grep 8443, I noticed that reply-to was sending the replies to my gateway (192.168.1.1) instead of the machine on the LAN.
I have fixed this by clicking on advanced options, and then checking disable reply-to.
All is well now.
Thank you! I was going in circles on this!
Is it possible to do this via console? It would be great at time of setup to be able to do this so I could then continue setup of a unit on my network rather than have to connect a laptop just to do this. I usually configure a 3rd interface to connect to my local LAN so the actual LAN interface of the firewall stays configured for client location setup.