Messages

Hi,

I've a configuration with LAN, WAN and DMZ, all pretty standard. The configuration is essentially migrated from an old m0n0wall firewall. Everything seems to work pretty fine (DMZ->WAN, LAN->WAN, WAN->LAN (via NAT), WAN->DMZ (via NAT), except that I cannot access hosts in DMZ from LAN and vice versa. If I do a port probe to a host in DMZ it works if Source is set to 'any' or 'DMZ', but not if it is set to LAN. So it definitely is a routing or firewall issue, not a wiring issue.

Firewall rules are

LAN: all protocols all sources to all destinations
DMZ: allow all protocols to any DMZ address from any LAN address
DMZ: allow traffic to specific hosts/ports in LAN from specific DMZ hosts

It's probably something stupid I forgot, but despite searching this forum and other sources I cannot figure out what I did wrong.

I don't have any virtual IPs. If the WAN address is .226, should I add the other 4 as virtual IPs?

1:1 NAT is not an option for us

Yes, WAN has multiple IP addresses. IP is configured as 217.100.205.226 / 29, gateway 217.100.205.225.

Our provider provided the following IP addresses:
.224 Network address
.225 Gateway
.226 - .230 free usable addresses
.231 broadcast address

Should I use the .224 address in the WAN configuration instead of .226 ?

Yes, I used the Port Forward page, and the firewall rules are automatically created.

Here's my NAT setup



Some ports are open for all incoming traffic on a certain WAN address, some (such as Remote Desktop) only for IP adresses of employee home addresses.

I know this question has been posted before, but the answers so far haven't helped me so I'm opening a new topic.

We are migrating from m0n0wall to opnsense. All seems to work well, except we can't get NAT working. All stuff without NAT, such as allowing https access to the firewall itself (for test purposes only) is working well. We're testing our connections from outside using 4G, so it's really from outside. When an outside connection is being tried, nothing is showed in the firewall logs. NAT rules (generally in form WANn port x -> LAN host port x) and corresponding firewall rules look fine. Typical behavior is not a refused connection but a timeout.

What am I doing wrong?

regards,

Frido