Allowing ports through a pfSense firewall

So you want someone to login remotely to access a specific resource on your network without exposing the rest of your systems to the dangers of the internet? These are the steps to follow to either create a new port or ports from a secured Linux distribution through a firewall using pfSense while still maintaining some semblance of security. There is much more that can be done for security, so we will just cover the basics for now. To start, you will need:

* The remote user's IPv4 address
* Which ports will be exposed to the user's IP address
* When to open and close the firewall for the user
* The internal server's IPv4 address

In addition, you will need the ability to make changes on:
* pfSense NAT and Firewall settings, as well as aliases
* pfSense Suricata, if applicable
* internal server firewall settings
* internal server network settings (only if server has gateway disabled)

A note regarding pfSense Aliases - if this is just a one-off server & port or port-range forwarding job, then Aliases are probably not for you. But, if you have multiple IP addresses, multiple ports, multiple users, whitelists, blacklists, etc then Aliases will make a huge difference in the way you use and configure your pfSense firewall. Basically, and alias is just that - a placeholder or pointer (shortcut) to represent several different numerical or named values with a simple name. For example, if there are several ip addresses that need to be forwarded to on Bob's network, then an Alias can be made for "bobs ip addresses" that would allow one rule being made instead of a duplicate rule for each ip address that needs forwarding to. This does take some thought and planning as its easy to forget what points to where, and create aliases that cause the firewall to operate in an unintended manner. A full description and how-to of Aliases in pfSense can be found at https://doc.pfsense.org/index.php/Aliases