Portforwarding Multiple WAN IP - Strange Behavior

[c90k]

Hi There,

We have an ISP Connection with multiple WAN IPs.
I Set up the Main IP years ago and everything worked as expected.
Because we having some services where the same ports need to be open, i though it would be an idea to manage that using the other WAN IPs.
So i Added the 2 Virtual IPs.

Now the Strange thing - the "old" Portforwardings (Firewall -> NAT -> Portforwarding) are set to "WAN address", but the ports are also open on the Virtual IPs.

When i Set a new Portforwarding with Destination "Virual IP1" for example, the open port is only visible on the Virual IP as expected.
What setting i have to use for the "Main WAN IP" or what im Missing here in my configuration ?
I want the Ports only open on the desired WAN IPs.

Regards, Chris

[Patrick M. Hausen]

WAN IP is an automatic alias that contains all addresses on the WAN interface.

You need to create manual aliases with just a single IP address each to use different port forward rules.

[c90k]

Hi Patrick,

Thx. That was the solution i came across in the mean time.
I thought WAN adress would be the single WAN IP, WAN net would be all IPs.

A further question, idk if its right here in the topic:
How i can make an OpenVPN Server only available on one desired IP ?
I Set up the bind address to 127.0.0.1 and the nat rule according, but its not working

Regards Chris

[Patrick M. Hausen]

That's how it's supposed to work. Please post your NAT rule if you need help.

[c90k]

Hi,
Thats my Config
1.) VPN --> OpenVPN --> Instances (new)
Bind Adress: 127.0.0.1
(First Screenshot)


2.) Firewall: NAT: Portforwarding
Interface: WAN
TCP/IP v4
UDP
Source: GeoIP_Allow (GEO Ip Filtering)
Destination: desired WAN IP
Dest. Port: 1198
Dest. IP: 127.0.0.1
(second Screenshot)

What im Missing ?

[Patrick M. Hausen]

What's the associated firewall rule set to? Try "pass" if you do not already.

[c90k]

Sorry, missed your reply.

I cannot change or view the firewall rule in detail, probably because it was generated via the nat rule
But here