From owner-freebsd-pf@FreeBSD.ORG Mon Jan 31 15:20:03 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DCDF4106564A for ; Mon, 31 Jan 2011 15:20:03 +0000 (UTC) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (106-30.3-213.fix.bluewin.ch [213.3.30.106]) by mx1.freebsd.org (Postfix) with ESMTP id BF3798FC16 for ; Mon, 31 Jan 2011 15:20:01 +0000 (UTC) Received: from insomnia.benzedrine.cx (localhost.benzedrine.cx [127.0.0.1]) by insomnia.benzedrine.cx (8.14.1/8.13.4) with ESMTP id p0VFK2gW031925 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO); Mon, 31 Jan 2011 16:20:02 +0100 (MET) Received: (from dhartmei@localhost) by insomnia.benzedrine.cx (8.14.1/8.12.10/Submit) id p0VFK1SJ003585; Mon, 31 Jan 2011 16:20:01 +0100 (MET) Date: Mon, 31 Jan 2011 16:20:01 +0100 From: Daniel Hartmeier To: andy thomas Message-ID: <20110131152001.GE5861@insomnia.benzedrine.cx> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.12-2006-07-14 Cc: freebsd-pf@freebsd.org Subject: Re: PF port forward problem with Sonicwall VPN X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jan 2011 15:20:03 -0000 On Fri, Jan 28, 2011 at 08:49:27AM +0000, andy thomas wrote: > and this works fine as I can access webmail on port 444. But why can't I > access the Sonicwall on port 444? Does anyone know if the Sonicwall uses > additional ports or has anyone got this device to with with a PF-based > firewall? First, I'd try to connect to the Sonicwall from the pf box itself, so it's using its local address. If that doesn't work, how's the pf box different from any other local client, for which this works? Then try and add NAT on the pf box' internal interface, so redirected connections should work like the previous test. If they don't, the problem clearly is with the pf box. But if they do work, but don't without NAT: Check if maybe the Sonicwall has a list of networks it accepts connections from. It might default to refuse connections from non-local networks. Also check if the Sonicwall has a correct default route. Without a correct default route, non-local connections would fail precisely in the way you describe... Kind regards, Daniel