Join Log in
Score:1
Saumya Kanta Swain avatar Server

OPNsense NAT/Port Forward: Forward multiple protocols and ports

vc flag
Saumya Kanta Swain

I want to forward ICMP and specific TCP and UDP ports on OPNsense but I'm unable to find a concise solution. Specifically I want to forward ICMP, http, https and UDP 32768-65535.

I'm adding a new port forward in the port forwarding section ("Firewall>NAT>Port Forward"). Here if I select "any" protocol, then I can not specify TCP/UDP ports. If I select TCP/UDP in protocol then specified ports will be open for both TCP and UDP and I can not specify ICMP with this. I can create separate rules for separate protocols but it seems unintuitive.

Will be glad to provide any further clarification if required.

Thanks in advance.

Update: I understand only TCP/UDP has concept of ports. I want to forward ICMP port for testing/reachability check and I'm forwarding an IP from my BGP network not one assigned to any interface like WAN. UDP 32768-65535 for a videoconferencing app (BigBlueButton). The UDP ports are not required in my case as my bigbluebutton and coturn instance are both inside the firewall.

I think it would be more intuitive if I could be able to list all ports/forwards for a NAT mapping at a single place. I felt there may be some way to enter a list like the following to a NAT. TCP/80, TCP/443, TCP/22, UDP/100:200, ICMP

From the current answer I think this is not available. I Will submit a feature request.

799
1 + 5
vidarlo avatar
ar flag
vidarlo
The feature request is likely to be ignored or answered negatively. What you ask fundamentally doesn't make sense; the underlying PF would have to handle this as multiple rules. PFSense (and OPNSense) tries to have a close mapping between underlying rules and what you see (and configure) in the web ui.
0
Reply
Saumya Kanta Swain avatar
vc flag
Saumya Kanta Swain
Oh! Thanks for the clarification. We are planning to migrate from Sophos UTM and I found this concept of Sophos a bit more organised. Have to live with the new interface then.
0
Reply
Saumya Kanta Swain avatar
vc flag
Saumya Kanta Swain
@vidarlo I don't know the exact internals but we can already specify an alias. In this case PF sense must be looping over the ports in an alias and creating separate rules. So if the aliases could optionally store the protocols along with the port then it can be nice.
0
Reply
vidarlo avatar
ar flag
vidarlo
PF can do port ranges as well :)
0
Reply
Saumya Kanta Swain avatar
vc flag
Saumya Kanta Swain
@vidarlo Ya, I know about port range. I can set a port range or even an alias range. But my issue is clubbing multiple protocols like 'x' port on TCP but 'y' on UDP. There is a protocol option TCP/UDP but it will open the same ports for both TCP and UDP. Created separate forwards for TCP and UDP at the moment. Will see what best can be done.
0
Reply
Score:1
vidarlo avatar Server
ar flag
vidarlo

Only TCP and UDP has the concept of ports. If you specify any as protocol, you can't specify ports, as it's not relevant for most protocols.

You'll have to make multiple forwarding rules:

  • ICMP
  • HTTP and HTTPS (80, 443)
  • UDP ports

This is not a problem; you can have as many forwarding rules as you want, all forwarding to the same destination.

0 + 2
Saumya Kanta Swain avatar
vc flag
Saumya Kanta Swain
Thanks! I've added an update to my answer for some clarification.
0
Reply
vidarlo avatar
ar flag
vidarlo
I removed the bit about XY-problem as it's clearly not relevant :) If the answer answers your question, you should consider accepting it and/or upvoting it.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.