1

question at the end.

Situation: (ips replaced by fictive examples)
I have a (remote) dedicated server, with 1 NIC, 2 IPs.
One IP (eg. 5.9.1.1) is bound to the physical NIC's MAC, the other (5.9.100.1) is assigned to a 'random' MAC.
No port filtering or NAT is present on remote network level.

ESXi (v5.5) security profile
Firewall is enabled.
All incoming connections except SSH, DHCP client, DNS client are restricted to 127.0.0.1-access only.
All outgoing connections except DHCP client, httpClient and DNS client are restricted to 127.0.0.1-access.
SSH-server service is enabled, with authorized key access only (no interactive login).

vSwitch0 (named WAN):

  • Bound to physical adapter vmnic0
  • VMKernel port for management network (gets the 5.9.1.1 IP)
  • Virtual machine port for pfSense (gets the 5.9.100.1, by overriding its MAC)

vSwitch1 (named LAN):

  • No physical adapter
  • Virtual machine port for pfSense (IP set to 192.168.174.1 - DHCP enabled)
  • Virtual machine port for Debian live cd (gets 192.168.174.10 from pfSense DHCP)
  • Virtual machine port for Windows 2012R2 (gets 192.168.174.11 from pfSense DHCP)
  • VMKernel port for management network (gets 192.168.174.12 from pfSense DHCP)

pfSense configuration:

pfSense is set up through regular wizard. WAN = vSwitch0, LAN = vSwitch1. DHCP server enabled.

NAT (all of these in the port forward tab):

  • General settings
    NAT reflection for port forwards: Disable
    Automatic outbound NAT for reflection: Disabled

  • RDP to Windows2012R2
    WAN-interface, proto TCP
    src *, src port *
    Dest address: WAN net, Dest port: 3389
    NAT IP 192.168.174.11, NAT port 3389

  • SSH to Debian Live
    WAN-interface, proto TCP
    src *, src port *
    Dest address: WAN net, Dest port: 2222
    NAT IP 192.168.174.10, NAT port 22

  • SSH to ESXi host
    WAN-interface, proto TCP
    src *, src port * Dest address: WAN net, Dest port: 22
    NAT IP 192.168.174.12. NAT port 22

Problem / Question:
RDP forwarding and SSH to debian works perfectly. I can connect to both from my home network.
However, if I try to connect from my home network to 5.9.100.1:22, my connection fails (timed out).

SSH from home to 5.9.1.1:22 works (I also use SSH tunnels to access vSphere).
SSH from Windows2012R2 VM 192.168.174.11 to ESXi host 192.168.174.12:22 works.

Considering the Debian SSH NAT-rule works, I am quite puzzled towards why the ESXi NAT-rule doesn't.
However, since I am new to both ESXi and pfSense, I am also unsure where to properly diagnose this issue.

Guesswork
Given that ESXi still has 'access' to the WAN-port (for now - lockout prevention), skipping pfSense altogether, it might just pick the wrong route to send traffic back to my home network.
If so: is there anything I can do to mitigate this problem with the current setup? If not - I might as well just set up the OpenVPN-server on pfSense and get over the port-fowarding issue altogether.

Thanks!

3
  • 2
    -- sorry, might be more of a 'Server Fault' topic?
    – sanderd
    Jan 18, 2015 at 2:09
  • I bit through the bullet and set up an OpenVPN 'Remote Access' server. Afterwards, removing the management from the WAN-vSwitch, 'solved' the issue at hand. All traffic from ESXi is now routed over the pfSense firewall - it has no other way out. As such, the SSH NAT rule now also works, but is no longer necessary.
    – sanderd
    Jan 20, 2015 at 10:25
  • I would agree that this question is better suited for ServerFault, but it looks like a home lab, and if that's the case, they will close it for being "off topic" (very stupid rule IMHO). Jun 27, 2017 at 12:53

0

You must log in to answer this question.

Browse other questions tagged .