NAT Port Forwarding not working for SSH

[spfld]

I'm having a problem getting NAT port forwarding working for SSH, but a nearly identical rule (different target IP but on the same LAN, different ports) for Plex works without a problem.

Internet <-> (FiOS DHCP address) FiOS router (192.168.1.1) <-> (192.168.1.201) OPNsense (192.168.2.1) <-> (192.168.2.33) SSH server

The FiOS router has 192.168.1.201 set as the DMZ host so all Internet traffic is being sent there. This all worked using a previous Linux box as the firewall (same Internet client, same FiOS router, same SSH server, same IP addresses & ports, etc.); the only change is the upgrade to the OPNsense firewall, so I'm confident that the other pieces are working.

tcpdump on the ssh server does see the incoming connection

Code Select Expand

# tcpdump -vv port 22
20:15:51.660109 IP (tos 0x0, ttl 50, id 28928, offset 0, flags [DF], proto TCP (6), length 60)
    remote.host.45618 > 192.168.2.33.ssh: Flags [S], cksum 0xcd3a (correct), seq 1454014126, win 64240, options [mss 1420,sackOK,TS val 1787846930 ecr 0,nop,wscale 7], length 0

but the remote ssh client immediately returns

Code Select Expand

ssh: connect to host example.dyndns.com port 2222: No route to host

without even a moment's pause.

Firewall > Settings > Advanced > "Disable reply-to on WAN rules" does not seem to make a difference.

OPNsense NAT rule and firewall log entries attached.

Any suggestions are appreciated. I'm probably missing something simple as I learn OPNsense. Thanks in advance!

[bartjsmit]

Try SSH with a port other than 22?

[Patrick M. Hausen]

Disable the global "anti-lockout" rule.

[spfld]

Try SSH with a port other than 22?

No difference if I have the SSH server listening on 2222 and port forward from 2222 to 2222.

Disable the global "anti-lockout" rule.

No difference here either, unfortunately.

[Bob.Dig]

Select FIOS Address instead of This Firewall.

[spfld]

Select FIOS Address instead of This Firewall.

Tried but still getting the "No route to host" error from the SSH client.

(FWIW, "This Firewall" works with the Plex NAT.)