This should be dead simple but for the life of me, I can't get it working. I must be doing something stupid.
I have a PFsense server with a public IP address. Behind it is three LAN segments:
[ Internet ] <---> [ pfSense]
+----- 192.168.1.1/24 ---> (multiple servers)
+----- 192.168.2.1/24 ---> (multiple servers)
+----- 172.16.1.1/24 ---> (multiple machines)
I have a new server with address 192.168.1.31
behind the pfSense server, and I want to give it a public IP. I assumed I would do this with a 1:1 NAT, but no matter what I ahve tried, it's not working. Here's what I did:
- In pfSense, I added a Virtual IP to the WAN interface with the new public IP I wanted. The first time, I used an "IP Alias" type.
- I added a 1:1 NAT rule with the new public IP as the external subnet, and
192.168.1.31/32
as the internal subnet. - I added a firewall rule on the WAN interface, protocol TCP, destination
192.168.1.31/32
, port rangeHTTP
-HTTP
. I did the same for another port in the 4000s where I wanted to run SSH.
After doing all of the above, I could not reach the new IP via HTTP, nor could I SSH into the new machine on the alternate SSH port I chose.
I changed the virtual IP to "Proxy ARP" and then to "Other", but neither of those worked either...
Oddly enough, I can SSH to the new IP on port 22, if I run the SSH server on 192.168.1.31:22
. But I can't get to any other ports.
What am I doing wrong here?