question at the end.
Situation: (ips replaced by fictive examples)
I have a (remote) dedicated server, with 1 NIC, 2 IPs.
One IP (eg. 5.9.1.1) is bound to the physical NIC's MAC, the other (5.9.100.1) is assigned to a 'random' MAC.
No port filtering or NAT is present on remote network level.
ESXi (v5.5) security profile
Firewall is enabled.
All incoming connections except SSH, DHCP client, DNS client are restricted to 127.0.0.1-access only.
All outgoing connections except DHCP client, httpClient and DNS client are restricted to 127.0.0.1-access.
SSH-server service is enabled, with authorized key access only (no interactive login).
vSwitch0 (named WAN):
- Bound to physical adapter vmnic0
- VMKernel port for management network (gets the 5.9.1.1 IP)
- Virtual machine port for pfSense (gets the 5.9.100.1, by overriding its MAC)
vSwitch1 (named LAN):
- No physical adapter
- Virtual machine port for pfSense (IP set to 192.168.174.1 - DHCP enabled)
- Virtual machine port for Debian live cd (gets 192.168.174.10 from pfSense DHCP)
- Virtual machine port for Windows 2012R2 (gets 192.168.174.11 from pfSense DHCP)
- VMKernel port for management network (gets 192.168.174.12 from pfSense DHCP)
pfSense configuration:
pfSense is set up through regular wizard. WAN = vSwitch0, LAN = vSwitch1. DHCP server enabled.
NAT (all of these in the port forward tab):
General settings
NAT reflection for port forwards: Disable
Automatic outbound NAT for reflection: DisabledRDP to Windows2012R2
WAN-interface, proto TCP
src *, src port *
Dest address: WAN net, Dest port: 3389
NAT IP 192.168.174.11, NAT port 3389SSH to Debian Live
WAN-interface, proto TCP
src *, src port *
Dest address: WAN net, Dest port: 2222
NAT IP 192.168.174.10, NAT port 22SSH to ESXi host
WAN-interface, proto TCP
src *, src port * Dest address: WAN net, Dest port: 22
NAT IP 192.168.174.12. NAT port 22
Problem / Question:
RDP forwarding and SSH to debian works perfectly. I can connect to both from my home network.
However, if I try to connect from my home network to 5.9.100.1:22, my connection fails (timed out).
SSH from home to 5.9.1.1:22 works (I also use SSH tunnels to access vSphere).
SSH from Windows2012R2 VM 192.168.174.11 to ESXi host 192.168.174.12:22 works.
Considering the Debian SSH NAT-rule works, I am quite puzzled towards why the ESXi NAT-rule doesn't.
However, since I am new to both ESXi and pfSense, I am also unsure where to properly diagnose this issue.
Guesswork
Given that ESXi still has 'access' to the WAN-port (for now - lockout prevention), skipping pfSense altogether, it might just pick the wrong route to send traffic back to my home network.
If so: is there anything I can do to mitigate this problem with the current setup? If not - I might as well just set up the OpenVPN-server on pfSense and get over the port-fowarding issue altogether.
Thanks!