Firewall issues

[tessierp (Patrick)]

Hi everyone,

So I recently configured HOME ASSISTANT to run in docker from my NAS system. The service is running and working, I can access it locally and created a PORT FORWARDING rule to push from the WAN to my internal service on port 8123.

The issues I am having is the following. If I try to access the Home Assistant service using the no-ip URL I configured to reach my Home Assistant, it didn’t want work from a machine in my GREEN network. I tried with my phone disconnected from WIFI (using the phone’s network) and it works.

So it seems that when I do this : GREEN (one of my PCs) -> RED -> GREEN (home assistant) that is blocked. So I thought, OK, I’ll try to set a RULE from GREEN to RED for the home assistant service, that didn’t work. I tried to set a rule in the LOCAL Rules, GREEN to FW and then the logs said it no longer REJECT the connection but ACCEPT it but still the connection was refused.

Anyone has any idea how to solve this? The reason I need this is I am using my Phone to let home assistant know that I am outside of my home and when that happens it should turn off devices. So from my phone, I will need to access home assistant outside of my network, but when I am back and connected on the network, it will no longer update my position to home assistant because of the problem I just described.

[tessierp (Patrick)]

Another odd issue I just noticed, if I create a RULE to REJECT traffic from the WAN to my Home Assistant, it wont work when the port forwarding is active. Is that normal??

[mrmarkuz (Markus Neuberger)]

@tessierp

PORT FORWARDING

If you want port forwarding to work from internal, you need to enable hairpin NAT in the firewall settings.

@tessierp

Is that normal??

Yes, port forward is respected first. You may disable the port forward (no need to delete) or block the port on the forwarded host.

[tessierp (Patrick)]

Enabling Hairpin NAT worked, thanks. Could you please give me some information on what hairpin NAT does? Just trying to better understand.

As for Port Forward being respected first that is good to know. Thanks!

[mrmarkuz (Markus Neuberger)]

Here is some information about hairpin NAT:

Hairpinning

More details:

https://wiki.mikrotik.com/wiki/Hairpin_NAT

[tessierp (Patrick)]

@mrmarkuz

Here is some information about hairpin NAT:

en.wikipedia.org

Hairpinning

In network computing, hairpinning (or NAT loopback) describes a communication between two hosts behind the same NAT device using their mapped endpoint. Because not all NAT devices support this communication configuration, applications must be aware of it. Hairpinning is where a machine on the LAN is able to access another machine on the LAN via the external IP address of the LAN/router (with port forwarding set up on the router to direct requests to the appropriate machine on the LAN). Consider…

More details:

https://wiki.mikrotik.com/wiki/Hairpin_NAT

Thanks for sharing!

[mrmarkuz (Markus Neuberger)]

You’re welcome.
If the issue is solved for you, please mark the most helpful answer as solution.

Howto mark a topic as solved

Now we have an amazing feature on our community platform which helps to mark a topic as SOLVED As the OP (topic creator) you will have a button that allows you to accept an answer [image] Accepted answers are highlighted in the topic list: [image] Accepted answers are highlighted on the initial topic: [image] This kind of action is enabled only for topic into the Support category Happy support!