External Access
Introduction
I will want access to various hosts for file shares and configuration. This is where I will describe it.
SSH Access
I will want access to the hosts inside the network not least the production hosts to continue the configuration while I am somewhere else. The problem is that Pfsense can only forward based on port so if I want to SSH to Lime from outside of the WAN port of Pfsense there is no way of the firewall from knowing that mean Lime and not Lemon. I could setup a bastion host to forward on SSH to the various hosts and I may well set it up at a later date just so that I know how but it is a bit of overkill for such a small number hosts. I have instead chosen to have each host listen at a different port so all I need is to have a table showing which port to which host, it will still be secure as it will still be SSH but instead. I will still need a firewall port forward rule for each host internally I will only need one pass rule for each interface because when I am "inside" there is no NAT so I can address the hosts by hostname.
Port Assignments
As previously stated each host will listen to SSH on a different port. The assignments are
- Raisin ..***02
- Lime ...****03
- Fig ....****04
- Logan ..****05
- NS1 ....****06
- Lemon ..****07
- Alpine .****08
- Plum ...****09
- strawberry**10
It would make sense to have them as aliases in Pfsense, each alias will take the form SSH_int_hostname. when testing try the user nigel@
