OPNsense Forum

Archive => 20.7 Legacy Series => Topic started by: Paweł on August 20, 2020, 04:36:32 PM

Title: NAT=>Port Forword redirects to wrong address
Post by: Paweł on August 20, 2020, 04:36:32 PM
Hello everyone!!

I have 2 rules in "NAT=>Port Forward" section:
1. WAN   TCP   *   *   WAN address      554   192.168.13.64   554
2. WAN   TCP   *   *   xxx.xxx.xxx.101   554   192.168.17.2   554

xxx.xxx.xxx.101 is additional virtual address associated to WAN interface.

First rule works fine. Everything is ok.

Second rule is clone of first rule. I've change only "Destination".

When I try to connect port 554 on address xxx.xxx.xxx.101, the connection failed. "Live view" shows the connection was not redirected to "192.168.17.2" but "192.168.13.64".

I observed this same issue with "MS RDP" protocol. I've walk around the problem by changing port number and publishing all RDPs on "WAN address".

In this case, I can't change the port number, because it is hard-coded into application.

Does anyone have idea, how make it working? Thank for any advice...

Keep healthy
Title: Re: NAT=>Port Forword redirects to wrong address
Post by: muchacha_grande on August 20, 2020, 05:47:53 PM
Hi,
what if you change the order.

Cheers...
Title: Re: NAT=>Port Forword redirects to wrong address
Post by: Paweł on August 21, 2020, 08:57:52 AM
Hi

Thx for answer.

No effect.

I've tried to publish other services on virtual IPs only. Not working.

Only redirects from the "WAN address" work as expected.

Cheers...
Title: Re: NAT=>Port Forword redirects to wrong address
Post by: Patrick M. Hausen on August 21, 2020, 12:23:41 PM
Is your virtual address of type "IP alias"?
Title: Re: NAT=>Port Forword redirects to wrong address
Post by: Paweł on August 21, 2020, 03:01:34 PM
Yes. Of course.
Title: Re: NAT=>Port Forword redirects to wrong address
Post by: Fright on August 21, 2020, 05:03:47 PM
try to view rules in Firewall-Diagnostics-pfInfo-Rules
may be some bug with "WAN address" alias or some...
try to use separate aliase for main IP, and new alias for virtual IP and write new forward rules.