I spent three hours last night fiddling with my new RB750GL, trying to get it fully configured to replace my previous pfSense installation (an ALIX 2C3).
So far I’m very happy with the hardware (already ordered a RB250 switch), and am gradually getting used to the software and CLI interface.
My WAN IP (ether1) is a static, 173.11.229.165/29. Default gateway is .166.
My LAN IP (ether2) is 192.168.2.1/24, and I have clients on the “local” LAN. .100 through .150 is setup as a DHCP pool, and others are various static IPs.
Basic NAT is working fine so far. What I’m having trouble with is port forwarding. I spent three hours working on this last night and have googled until
my fingers are blue, and figure it’s time to just ask.
I need to forward:
(external) 173.11.229.165 port 2222 to (internal) 192.168.2.15 port 22
(external) 173.11.229.165 port 9091 to (internal) 192.168.2.15 port 9091 (there’s no line for this in the config right now)
All clients on the “inside” should have unrestricted access through the NAT to the outside. Ping, DNS, IPSEC, etc, should all work.
“/ip route print”:
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 173.11.229.166 1
1 ADC 173.11.229.160/29 173.11.229.165 ether1 0
2 ADC 192.168.2.0/24 192.168.2.1 ether2 0
“/ip firewall filter print”:
0 ;;; accept established connection packets
chain=input action=accept connection-state=established
1 ;;; accept related connection packets
chain=input action=accept connection-state=related
2 ;;; drop invalid packets
chain=input action=drop connection-state=invalid
3 ;;; Allow Broadcast Traffic
chain=input action=accept dst-address-type=broadcast
4 ;;; jump to chain ICMP
chain=input action=jump jump-target=ICMP protocol=icmp
5 ;;; jump to chain services
chain=input action=jump jump-target=services
6 ;;; 0:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=0:0-255 limit=5,5
7 ;;; 3:3 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=3:3 limit=5,5
8 ;;; 3:4 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=3:4 limit=5,5
9 ;;; 8:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=8:0-255 limit=5,5
10 ;;; 11:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=11:0-255 limit=5,5
11 ;;; Drop everything else
chain=ICMP action=drop protocol=icmp
12 ;;; accept localhost
chain=services action=accept dst-address=127.0.0.1
src-address-list=127.0.0.1
13 ;;; allow DNS request
chain=services action=accept protocol=tcp dst-port=53
14 ;;; Allow DNS request
chain=services action=accept protocol=udp dst-port=53
15 ;;; UPnP
chain=services action=accept protocol=udp dst-port=1900
16 ;;; UPnP
chain=services action=accept protocol=tcp dst-port=2828
17 ;;; allow DHCP
chain=services action=accept protocol=udp dst-port=67-68
“/ip firewall nat print”:
0 chain=dstnat action=dst-nat to-addresses=192.168.2.15 to-ports=22
protocol=tcp dst-address-type=local dst-port=2222
1 chain=srcnat action=masquerade
I’ve figured out that I need to allow incoming TCP port 2222 in the “firewall filter” section before I can redirect it in the “firewall nat” section,
but nothing seems to be working. Any general suggestions for improvements would be appreciated.
Thanks in advance.