NAT/Firewall + Port Forwarding to Webserver

[K1LL9]

Hi all,

Trying to pass web traffic through to a CentOS VM on my internal WLAN from a WAN address.

Devices on my WLAN (172.16.99.X) can access my webserver (172.16.99.27:801) fine.

When trying to access my WebServer externally, I can't even see requests (Firewall Live Log) been made from my mobile device on the WAN (102.X.X.X) to my web server.

I have set up a NAT rule:
Interface: WAN
Proto: TCP
Src Address: 102.X.X.X
Src Port: *
Des Address: 172.16.99.27
Des Port: *
NAT IP: 172.16.99.27
NAT Port: 801
Log: Enabled
NAT Reflectoin: Enabled

I even tried enabling NAT Reflection under Firewall -> Advance as per a perious article in OPNsense.

I am struggling to troubleshoot when I don't see any logs in Live View. Thanks in advance 

System:
Versions   OPNsense 21.7.1-amd64
FreeBSD 12.1-RELEASE-p19-HBSD
LibreSSL 3.3.3

[WholesomeTRex]

Glad I'm not the only one.

I upgraded to 21.7.1 through live upgrade, and also through a new install but having issues where I'm not able to get anything passed through. Nothing in 80, 443, 1194, and 1195. Nothing.

I think filling out an issue will help. As for now, I'm going to revert to an older version. Thank God I have a working snapshot.

[WholesomeTRex]

Glad I'm not the only one.

I upgraded to 21.7.1 through live upgrade, and also through a new install but having issues where I'm not able to get anything passed through. Nothing in 80, 443, 1194, and 1195. Nothing.

I think filling out an issue will help. As for now, I'm going to revert to an older version. Thank God I have a working snapshot.

So a new development has occurred. I went and setup a new ESXi VM and installed 21.1

I had taken a snapshot of my OPNsense VM prior to the upgrade and once this behavior was discovered I rolled it back to the previous snapshot (21.1.x) and the functionality was working as normal.

I attempted to utilize opnsense-revert but it appears that only works for specific packages and not the entire release. I then installed previous versions starting at 21.1, then auto-upgraded to 21.1.9_1-amd64. Found that I was still able to utilize the port forwarding correctly.
When I upgraded to 21.7 (no minor version) I was able to confirm that I was still able to utilize the port forwarding as expected. I took another VM snapshot at this point.

I then ran the upgrade and it said it was going to upgrade to 21.7.2. However, once you actually proceed with the install, there is a part where it shows "Installed packages to be UPGRADED:" and it shows that opnsense: 21.7 -> 21.7.3_3
So it appears as though the information in the update is partially wrong as well.  It did, in fact, upgrade to 21.7.3_3.

Finally, and I'm not sure how... but I have confirmed that 21.7.3_3 is working with port forwarding... for 5 minutes... maybe. Then, as I started writing up this information to you, I kept testing it ... and it started timing out.
I rolled back to 21.7 (with no configurations other than the port forwarding, and it still continues to time out. This is happening from multiple devices and I'm positive that my DNS is working properly as nothing has changed there.

I rolled back to 21.1.9_1 and for some reason it's still not working properly.

I ended up just moving to 21.1.9_1 fresh install and am going to sit with that for a while until we can confirm everything stays working in newer versions.


I know this isn't a great solution, but something you may want to consider.

[FraLem]

Hi,

Port forwarding is running fine for me on OPNsense 21.1.8_1.

May I suggest to check your firewall rules?

Rgds