Rules on port forwarded ports not working?

[ckoehler]

Hi there,

I set up a port forward rule for something. It works great. I forward port 20500 to some inside device 10.10.10.25:12200.
I want to restrict access to port 20500 from the outside, but that port shows up nowhere in the reports to block.

What I do see in Firewall's All Events is connections from remote clients directly to 10.10.10.25:12200, but nothing going to 20500 on Untangle.

What am I missing? Thanks!

[jcoffin]

Add conditions to the port forward rule to restrict the port forward to specific source addresses and such

[ckoehler]

Thanks, but that doesn't have all I want. I'd like to block by country and stuff. I guess it works if I make that rule from remote client to 10.10.10.25:12200, but that's a bit unintuitive.

[jcoffin]

Use the firewall app for country blocking. I personally use it.

- Make a policy for all the port forwards to use.
- Add firewall app to this policy.
- Add firewall rule as below.

firewall-country-rule3.png.jpg

[sky-knight]

All of the rack applications work post NAT. All of the networking tab is pre NAT.

So if you want to make a firewall rule, it's going to match on the destination and port INSIDE. That is to say the NEW address and the NEW port from the forward rule.

[ckoehler]

Use the firewall app for country blocking. I personally use it.

- Make a policy for all the port forwards to use.
- Add firewall app to this policy.
- Add firewall rule as below.

firewall-country-rule3.png.jpg

Got it, I do something like that that works fine. It was the clarification that Firewall happens Post-NAT that I needed. Thanks!

All of the rack applications work post NAT. All of the networking tab is pre NAT.

So if you want to make a firewall rule, it's going to match on the destination and port INSIDE. That is to say the NEW address and the NEW port from the forward rule.

Aaah that makes sense, thank you!

[HunterxXx]

thanks, this one was useful