Our goal: to set up port forwarding through a FreeBSD-based router to specific computers on the internal network.
Port forwarding: this is when someone hits the external IP of your router (its public IP) on a specific port, and the router redirects that traffic (arriving on that port) to a specific computer inside the local (or private) network, without processing it itself.
For example, you have a router with external IP 11.22.33.44 and an internal local network 192.168.0.0/24. For example, you want all clients connecting to IP 11.22.33.44 on port 25 to actually reach the computer 192.168.0.10. That's what "port forwarding" is.
So, we should already have a configured and working NAT set up. We've already written about how to do that
Now open the file with the NATd settings (for example, /usr/local/etc/natd.conf) and add lines like this (example):
redirect_port tcp 192.168.0.10:25 25
redirect_port udp 192.168.0.33:53 53
redirect_port tcp 192.168.0.1:3389 12345
In this example:
- Traffic going to your router's external IP on port 25 over TCP will be forwarded to the computer 192.168.0.10 on the same port 25.
- Traffic going to your router's external IP on port 53 over UDP will be forwarded to the computer 192.168.0.33 on the same port 53.
- Traffic going to your router's external IP on port 12345 over TCP will be forwarded to the computer 192.168.0.1 on a different port - port 3389.
This is, of course, just an example. But the essence of composing the rules should be clear to you - replace the internal IPs with the ones you need, and the ports with the ones you need.
Now restart NATd. We've also written about that before.
And give it a try.
P.S. A common mistake is trying to test port forwarding from inside the local network - i.e., from private addresses. It won't work, because the traffic needs to arrive from the internet on the network card facing outward. So port forwarding simply cannot be verified from inside your own network.
Applies to: FreeBSD 6.x and above
Comments