Allow GUI access on WAN when WAN is on the LAN

[ArrayElement]

I am trying to use opnsense to create a lab environment.

The topology is this:

LABLAN (192.168.252.0/22) <--> WANLAN (192.168.1.97) <--> REALWAN (public internet).

So, this is a lab network that is inside our office network, where the lab network's "WAN" address is a private IP address on our LAN.

This works, and the machines on the LABLAN can access the internet (Example path: 192.168.252.100 -> 192.168.252.1 -> 192.168.1.97 -> 192.168.1.1 -> public internet

Here's my problem:
I want to be able to manage the firewall from the office LAN (192.168.1.100), which means I have to access the OpnSense firewall on 192.168.1.97.

To do this, I took the following steps:

• Turned off "block private networks"

Turned off bogon networks (not really related, but I did do this).[/li]
[li]Changed the management port to 8443[/li][/list]
Created a NAT rule to forward TCP with a destination of 8443 on the WAN address to the LAN address for the firewall at the same port
[/list]

This does not work. Firewall logs show that the traffic was allowed (I see a "pass" entry with the source IP of my workstation and a destination IP of the WAN), but I cannot access the gui.

This works with pfSense, tomato firmware, and other firewalls I have used. But, it seems I have missed a step here.

Does anyone know how to make this work?

[ArrayElement]

I figured it out. Doing a dump with pfctl -sr | grep 8443, I noticed that reply-to was sending the replies to my gateway (192.168.1.1) instead of the machine on the LAN.

I have fixed this by clicking on advanced options, and then checking disable reply-to.

All is well now.

[kapara]

Thank you!  I was going in circles on this!

[kapara]

Is it possible to do this via console?  It would be great at time of setup to be able to do this so I could then continue setup of a unit on my network rather than have to connect a laptop just to do this.  I usually configure a 3rd interface to connect to my local LAN so the actual LAN interface of the firewall stays configured for client location setup.