Text only | Text with Images

OPNsense Forum

English Forums => General Discussion => Topic started by: nj44451 on December 17, 2022, 06:45:29 PM

Title: pass only a specific block of external IP ranges to an internal port
Post by: nj44451 on December 17, 2022, 06:45:29 PM
I have an external spam filter that passes mail to my mail server on port 25.

I want to ensure that only mail from the spam filter is delivered to my mail server.

I setup an alias with the IP ranges for the spam filters public ip address but the server gets blocked no matter what I try.

I am setting this up on the NAT port forward.


Do anyone have an example of how to set this up?
for example I have this range setup in the alias:    72.35.12.0/255.255.255.0

Thanks,

Trent


Title: Re: pass only a specific block of external IP ranges to an internal port
Post by: Patrick M. Hausen on December 17, 2022, 08:14:54 PM
What is the "associated filter rule" in your NAT port forward rule set to? If it is not "pass", then try that.

Also:

source: your spam filter alias
destination: WAN address
Title: Re: pass only a specific block of external IP ranges to an internal port
Post by: nj44451 on December 17, 2022, 08:28:13 PM
I had tried before adding the alias to the source and nothing.

I just modified the existing NAT I had for pass the traffic to my local IP on port 25

in the alias if shows it loaded the whole range of ip based on the masks I set.

for example I have this range setup in the alias:    72.35.12.0/255.255.255.0

I have it setup as a URL alias should I be using something else?

Here is what I see in the live log. 

wan      2022-12-17T14:25:56-05:00   72.35.12.47:50702   98.157.240.17:25   tcp   Default deny / state violation rule
Title: Re: pass only a specific block of external IP ranges to an internal port
Post by: Patrick M. Hausen on December 17, 2022, 08:33:19 PM
Please post all details of that NAT port forward rule.
Title: Re: pass only a specific block of external IP ranges to an internal port
Post by: nj44451 on December 17, 2022, 08:44:05 PM
this is what is set the works to pass on port 25 to the server
Nat under port forward

WAN   TCP   *   *   WAN address   25 (SMTP)   192.168.1.54   25 (SMTP)   

As soon as I add the alias as the source addresses  it gets blocked

WAN   TCP   SMTP_alias   *   WAN address   25 (SMTP)   192.168.1.54   25 (SMTP)   


under alias "SMTP_alias" I have it set to URL (ips)

With these addresses added

72.35.12.0/255.255.255.0
72.35.23.0/255.255.255.0
208.70.128.0/255.255.248.0

Title: Re: pass only a specific block of external IP ranges to an internal port
Post by: Patrick M. Hausen on December 17, 2022, 09:19:10 PM
Use an alias of type Network(s) and specify the networks as

72.35.12.0/24
72.35.23.0/24
208.70.128.0/21
Title: Re: pass only a specific block of external IP ranges to an internal port
Post by: nj44451 on December 18, 2022, 03:59:31 PM
Changed to Networks and all is working now also I think at one point I forgot to click apply as well.

Thanks for your help.
Text only | Text with Images