Restricted port forwarding

Question

Hi
I would like to configure port forwarding for only one remote address.
The situation is like this: I have two domains ( adddresses 10.0.0.0/8 and 192.168.1.0/24 ) and a very narrow minded router that only allows port 80 en 443 and in one direction. Servers in 192.168 also have an exta nic with 10.20 addresses.
The server at 10.10.10.38 needs to connect to MySQL in the other domain so I thought I could use port 443 and forward it to 3306.
When I use "netsh interface portproxy" I cannot restrict to 10.10.10.38 (everyone gets access), but configuring a firewall rule with local port=3306, remote port=443 for remote IP address 10.10.10.38 does not function as a port forwarder (so no-one
gets access).
How should I configure the firewall (Windows Server 2008 R2) ?
Regards,
Rob

Answer 1

Hi Rob,
First, let us learn more details about portproxy and clarify our thoughts. We configure the Windows Server 2008 R2 as the portproxy server.
When we use "netsh interface portproxy add v4tov4" command, we should specify those parameters, listenport=443,connectaddress=the IP address of MySQL computer, connectport=3306,listenaddress=local
IP address,protocol=TCP.
Then if the portproxy server monitored messages that were sent to port 443 and local IP address, it would forward the messages to port
3306 and to IP address of MySQL computer after establishing a separate TCP connection. The portproxy server was listening to port 443, if it discovers that some messages arrive at port 443, it would forward the messages to the port 3306 of MySQL server.
But this process couldn’t configure the portproxy server to restrict to 10.10.10.38. Our goals is, when 10.10.10.38 access Windows Server
2008 R2 IP address:443, the firewall allows the connection, then messages were forwarded to MySQL server IP address:3306. But if other clients want to access Windows Server 2008 R2 IP address:443,the firewall will block the connection. So we should configure
a firewall rule in the portproxy server. As we mentioned above, when we open port 443, we could only add 10.10.10.38 in the remote IP addresses.
Overall, portproxy works behind the firewall, they work together to achieve the above goal. And the result is:Client
request port 443 -----> Firewall of portproxy server allows 10.10.10.38
to pass -----> Portproxy server forward messages from port 443 to 3306.
Finally, the problem is that the restriction by the firewall does not work. To ensure the firewall works fine, we could disable all rules
except the rules we configured. Then try it again.
Best Regards,
Tina