Quote from: EricPerl on June 05, 2025, 01:05:11 AMFYI, 'WAN Address' is the IP assigned to the WAN interface likely via DHCP.
'This Firewall' is the collection of IPs assigned to all interfaces.
Using 'This Firewall' makes sense for FW rules where an IP associated with the FW might do.
It makes less sense on a port forward on a single interface where only one of the IPs is relevant.
Thanks for that, I had assumed that's how it worked so was using it interchangeably for testing, but you're right, I should have used "WAN Address" in the first instant and carried it through.
Quote from: EricPerl on June 05, 2025, 01:05:11 AMIt looks to me like no traffic is coming back from the Linux VM.
Have you confirmed outbound network connectivity from that VM (IP, ping, DNS, light browsing) as a way to establish some baseline on network connectivity?
Have you confirmed that you can connect to it from its LAN? Or even just from OPN?
Is sshd even installed and running?Code Selectsystemctl status sshd
Edit:
That last screenshot is ssh into OPN? It looks rather healthy.
Yup, the last screenshot is ssh from another Linux VM on the same VLAN 60 (10.2.1.48 from memory, I've taken it down now) which I used to successfully test whether a "This Firewall" port forward would allow it to ssh to 10.2.1.1 and have its traffic forwarded to 10.2.1.54 (the test VM with sshd running). Worked fine.
10.2.1.54 is able to:
ping 10.2.1.1, andping 8.8.8.8 when I have an Outbound NAT rule enabled, andping the laptop (192.168.50.10) on the VLAN50 interfacessh to another offsite server when I have an Outbound NAT rule enabled
...and just in the middle of typing that I found the problem.
The linux VM was also bridged to vmbr0, a bridge on proxmox, and had an IP of 192.168.50.30 on that interface. It was not a fresh VM and I had that up to enable updating and installing openssh-server from memory.
When I SSH'd from the laptop to the firewall (192.168.50.67) it correctly NAT'd to 10.2.1.54, but when 10.2.1.54 replied it logically routed back through the other interface (or didn't reply at all, who knows).
I deactivated the interface to vmbr0 and it worked :-)
Many thanks for your help! I'm still keen to know why the rules in the original post didn't fire, but as I can no longer replicate that behaviour I'll have to make that a problem for later.
As the original question remains, do I still (and how) mark this thread as solved?