Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently (meaning 4 days ago) set up a pfSense firewall/router box. It works amazingly well. I'm having a few problems though:

1) I can't seem to SSH into the box remotely despite enabling SSH. I can, however, access the box's SSH internally. I'm currently working around this by SSHing to an internal box (via port 2222) then SSHing to the box from "inside".

2) I can't access the box's web page remotely. Currently working around this by SSH port forwarding through the previously mentioned box.

3) I can't access forwarded ports internally. I have seen this documentation item (link text), but I'm trying to decide on safety vs ease-of-configuration.

FYI, my setup is as follows:

[INTERNET]  <--> ["DUMB" DSL MODEM (in "bridge" mode passing external IP on to pfSense)] <--> [pfSense box] <--> [24-port gig switch] <--> [OFFICE COMPUTERS]
share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Opening holes for external access to your firewall is considered bad security practice. As far as I know pfsense has built-in VPN capability: both IPsec and PPTP can be used.

For PPTP you can use windows as well as linux client software to connect. Here is official pfsense documentation on PPTP VPN.

For setting up PPTP on Linux, visit pptp client website.

share|improve this answer
    
Fair enough, but I need to be able to perform certain actions (some automated) without having the VPN take over network activity. For instance, I have a GIT repository on one of the internal servers. Having to connect to a VPN every 15-30 minutes to push/pull updates, etc. from home would get out of hand. Admittedly, this won't be as much trouble on the Mac side as controlling my traffic is as simple as checking a box. However, my Ubuntu boxes seem determined to pass all traffic over VPN without regard for any of the various PPTP client settings. (Any ideas here?) –  humble_coder Aug 24 '09 at 12:02
    
Also, the office network is on the same subnet (192.168.1.0/24) as my home network, so VPNing would cause a whole different array of issues as I'm absolutely sure that some of the internal machines have the same IP as some of my local machines. The issue being, once I fix the "send all traffic" I still need to figure out how to route web traffic to check internal application servers while not breaking access to my home servers. Maybe I can't have my cake and eat it to, but those are my issues. –  humble_coder Aug 24 '09 at 12:03
3  
One obvious way to do it: renumber your home network. –  Taras Chuhay Aug 25 '09 at 20:44
add comment

You need to make sure that there is a hole in your firewall to allow incoming traffic on port 22.

Do not, under any circumstances allow incoming traffic on port 80, or 443.

If you want, I would recommend setting up a ssh key. That way you don't have to give a password every time you login.

share|improve this answer
    
Why not allow 80 or 445 in? –  Bill Weiss Sep 22 '09 at 21:07
    
You probably don't need web(80) access, or ssl web(445) access. –  Brad Gilbert Sep 24 '09 at 19:57
    
SSL HTTP is port 443, not 445. –  Josh May 12 '11 at 20:05
add comment

If you need external ssh access to your PFSense box, you need to setup NAT and open a firewall port (of course, PFSense does both for you at once if you let it). When you select ssh access through the web interface, it enables ssh on the lan port.

If you router had a lan interface of 192.168.1.1, you'd set up a nat pointing the external port you want to use (maybe something like 2222 instead of the standard 22 for a little bit of obscurity) to port 22 (or whatever you chose when you enabled ssh) on 192.168.1.1.

You can do the same thing for web access, but please don't and if you must at least enable https support only. You can also use the firewall settings to then limit access to only some hosts if appropriate. (ie. only access the work router from home or vice versa)..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.