Accesss NRPE@jail from the Internet

[Irina Liakh]

Hello everyone!

I have NRPE daemon installed and running on a jail, and I need to access it from the Internet. Since there is no dedicated router that can do port forwarding for the jail, I suppose I need port forwarding on the FreeNAS itself. I tried these ipfw rules:

ipfw show:
00110 18 3772 nat 110 tcp from any to $NAS_IP dst-port 5666
00111 28 7776 nat 110 tcp from $JAIL_IP 5666 to any

ipfw nat show config:
ipfw nat 110 config log redirect_addr $JAIL_IP $NAS_IP

(NAS_IP is a public IP address and JAIL_IP is a private IP address).

All is working fine but there is a problem: how to keep these ipfw rules through FreeNAS reboot and through the jail restart?

The more general question is: what is the most legitime way to set up NRPE on FreeNAS visible from the Internet while there is no any router to portforward to the jail private IP, and there is no additional public IP?

 

[dlavigne]

how to keep these ipfw rules through FreeNAS reboot and through the jail restart?

The more general question is: what is the most legitime way to set up NRPE on FreeNAS visible from the Internet while there is no any router to portforward to the jail private IP, and there is no additional public IP?

There isn't as FreeNAS is not designed to do this and this is considered to be an unsupported scenario.

 

[pirateghost]

You don't have a router?

And your FreeNAS is directly attached to the Internet?

 

[Irina Liakh]

There isn't as FreeNAS is not designed to do this and this is considered to be an unsupported scenario.

Thank you! Will use a workaround.

You don't have a router?

And your FreeNAS is directly attached to the Internet?

Direct attach implies a router as well ;)
Of course, there is a router ahead, but it does not imply customizing such as port forwarding.

 

[pirateghost]

Thank you! Will use a workaround.

Direct attach implies a router as well ;)
Of course, there is a router ahead, but it does not imply customizing such as port forwarding.

Then how do you access your FreeNAS over the internet?

If you are natted, you have to forward a port to get to a service.

 

[Irina Liakh]

how do you access your FreeNAS over the internet?

Please see the startpost.
Thank you for your interest.

 

[pirateghost]

Please see the startpost.
Thank you for your interest.

Why on earth would you put your NAS directly attached to the Internet?

 

[Irina Liakh]

Why on earth would you put your NAS directly attached to the Internet?

Why not?

 

[pirateghost]

Why not?

I can't believe I would have to explain why having your NAS directly connected to the internet without a firewall is a bad idea....

 

[danb35]

Why not?

Because presumably you don't want @Russian Mafia pwning your system. FreeNAS is not designed or hardened to be directly exposed to the Internet, and should only be used behind a firewall.

 

[Irina Liakh]

danb35, thank you for your attention.
Direct access (as opposed to NATted access) does not automatically imply that there is no any firewall ahead.

 

[pirateghost]

You're going to have to provide a whole lot more details as to your network layout. You're being very vague on your setup.

 

[Irina Liakh]

pirateghost, sorry, I don't see how any additional details may be significant for my question.

 

[pirateghost]

pirateghost, sorry, I don't see how any additional details may be significant for my question.

Ok. Good luck with your endeavors. I hope you figure something out.

 

[Irina Liakh]

Already figured out (see the very first reply on the starttopic).
Wonder why you were asking all your questions.

 

[pirateghost]

Already figured out (see the very first reply on the starttopic).
Wonder why you were asking all your questions.

It was to determine if there was a better option available to you.

Do it however you like.

 

[Irina Liakh]

It was to determine if there was a better option available to you.

Thank you! But I mentioned that there is no way to configure NAT on routers. There is no way to modify net topology either. Sorry if it was not clear at once.
So the only place I can affect is the FreeNAS itself, isn't it?