Does this exist in IPFire?

[ms (Michael Tremer)]

Hello Sean,

@seanp

Hi Michael,
I hope you are well. My name is Sean, and I am new to IPFire.

Welcome. I have made your PM a public post because this question might be interesting for more people.

@seanp

We may open an SSH port to an internal system for a client using the default red IP, with a unique port externally. For example port 55522 externally, forwarded to port 22 internally.

This is possible in IPFire with a standard Port Forwarding rule with just a different external port.

@seanp

If the client needs a public IP assigned, you create an alias with the “Map from IP address” to the LAN address of the internal system. Then, when you create the rule from the alias to the internal system (port 22 externally to port 22 internally), you see the alias IP remotely as the public IP being used.

What is the use-case for this?

I am sure you can do the same by creating a second SNAT rule to NAT everything to the firewall’s addresses, but I would regard this as bad network design. There is no apparent need for this.

@seanp

Then, when you create the rule from the alias to the internal system (port 22 externally to port 22 internally), you see the alias IP remotely as the public IP being used.

If you want to connect to the public alias IP address from an internal network on port 22, you would have to create a second DNAT rule as the first one (using port 55522) would not match.

@seanp

With the way IPFire does it, the SNAT rule forces all connections from the internal systems to be the alias IP, regardless of which public IP you used to connect to the system.

As in, the SNAT rule matches even though you are coming back to the internal system? That is pretty much how this is designed. You can of course use a separate destination network to make the rule more conditional.

Why would you even go to the firewall and back when you want to connect to an internal host? This would not really scale.

-Michael