Port Forwarding not respecting Selected Sources

February 05, 2025 16:42

I have recently begun hosting my Nginx Proxy Manager and Uptime Kuma instances on my Firewalla itself within Docker. Since I did not want to potentially mess up the iptables rules, I used the Port Forwarding setting and set source/dest port 443 from my WAN to 192.168.5.1, the IP of the Firewalla in one of my VLANs. I then set the source to my Cloudflare IPs target list. Obviously without this port forward, I cannot reach my Nginx proxied sites or my Uptime Kuma instance externally.

The issue arrises when, with my target list as the only selected source, you can still reach my port forwarded service outside of Cloudflare's IP range. If I do `http://my_ip:443` I am given a 400 response seen below from OpenResty (one of the components of Nginx Proxy Manager). This indicates the selected sources are not being respected.

For reference, here's is the content of the target list:

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

And it can be found at https://cloudflare.com/ips-v4

Comments

7 comments

Firewalla

February 05, 2025 16:44
When you are port forwarding, you can't port forward to firewalla itself, you will need to port forward to a device on the LAN. Is this what you are doing?

" used the Port Forwarding setting and set source/dest port 443 from my WAN to 192.168.5.1, the IP of the Firewalla in one of my VLANs."

Is this a new firewalla?
0

Comment actions Permalink
sedimentary

February 05, 2025 16:49
Thanks for the quick reply! Yes, I am port forwarding to the Firewalla itself. It does work, because it does route, it just does not respect the selected sources and instead allows everything ingress. This is a Firewalla Gold SE.
0

Comment actions Permalink
sedimentary

February 05, 2025 16:57
Here is the port forward itself out of iptables:
```
Chain FW_PRERT_PORT_FORWARD (1 references)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:https to:192.168.5.1:443
```
And again, in the Firewalla app I set my personal Cloudflare IPs as a selected source for ingress. It does not appear to have respect that at all, given "source anywhere" in the iptables rule.
0

Comment actions Permalink
Firewalla

February 05, 2025 19:52
If you are trying to use raw Linux (iptable), the tables are extremely complex, and we can't guarantee each version they will be the same.
0

Comment actions Permalink
sedimentary

February 05, 2025 19:54
I'm not, I was just showing the rule the Firewalla app created as proof that it is not respecting my target list. This appears to be a bug.
0

Comment actions Permalink
Firewalla Team

February 06, 2025 02:26
It's normal that the source is 'anywhere' for the DNAT rule. No worries. If you want to do port forwarding for your Docker, you need to port forward to your Docker IP, not Firewalla.
0

Comment actions Permalink
sedimentary

February 06, 2025 02:28
Where can I find the filtering being performed in that case? I can't find the Cloudflare subnets in any table in the rules, and as far as port forwarding, the docker container does not have an IP, it is using the host network so it is residing on the Firewalla interfaces.
0

Comment actions Permalink

Please sign in to leave a comment.

Comments

Didn't find what you were looking for?