Can't anyone help me ?
I tried pretty much everything I could imagine..
I've tried also with siproxd without success either.
As soon as I remove my pfsense appliance and return to my previous router voip is working.
I can see that sip is working (registration is ok in the Ata and it show inbound and outbound sip traffic) but for rtp, only outbound and 0 inbound traffic....

@KOM

Thank you!!
answered everything

Kind Regards
Kinch

Something is not quit right here. You said the symptom of the problem was that you could access your local game server on LAN, but your users on WAN could not. NAT reflection will not address that issue. I suspect that there was a problem with the NAT you created and you somehow fixed it but thought it had to do with NAT reflection.

@shetu said in Port Forward not working:

Last question what is difference between DMZ and Super DMZ (netis router)? I put my pfsense mac address to Super DMZ, it was not working.

Read the netis router manual, this has nothing to do with pfSense. And "Super DMZ" is not a common term in networking, but rather some manufacturer specific thing.

@marcus-horne said in Mobile client IKEv2 vpn, access to remote network(IPSec):

But i have no

https://www.netgate.com/docs/pfsense/vpn/ipsec/configuring-an-ipsec-remote-access-mobile-vpn-using-ikev2-with-eap-mschapv2.html

Automatic outbound NAT should be fine.

"To pass all traffic, including Internet traffic, across the VPN, set the Local Network to 0.0.0.0/0" << this routes all the client traffic over the VPN.

If you want specific clients to receive a specific IP rather than an address out the range check this out:-

https://forum.netgate.com/topic/115795/guide-ikev2-ipsec-per-user-firewall-rule-settings-with-freeradius

Thanks i send you the upload

Correct, sorry. I actually did what you mentioned above and it did sync to the secondary. Thanks.

Did you check what your WAN IP is? By default LAN IP on pfSense is 192.168.1.1 but sometimes default IP-pool from ISP equipment is 192.168.1.0/24 and in this case you have to change LAN IP-subnet.
Did you connect your server to LAN port or OPT?
What are your Outbound NAT Rules and Firewall Rules for LAN/OPT?

If you are already connected to a site that has that network, then the other side must do NAT, not you. There isn't a way for you to hide that conflict using a single firewall.

There are some ugly ways around it, like setting up a second firewall to handle that one VPN and do NAT between your main firewall and that firewall, but it's not ideal.

You could also renumber your LAN, but that would be significantly more work.

@_neok I decided to put a router to not touch so much my pfSense, since I have other links and that way I have the cleanest configuration.
Greetings!

If you see a state, it has passed the firewall.

Check your target box. It's either not on, or it's blocked there. Most likely not a pfSense issue.

Nowhere close to enough detail here to even hazard a guess.

@jimp I tried to do the same but no error has been received. i think it is fixed but i didn't install any patches to fix this. I don't know how the issue was resolved automatically...Please update....

Why should the thread be closed? You can mark it solved yourself.. Other users might have questions and or comments.. I for one have a comment to the personal insult remark..

If you took that as personal - sorry but your in idiot ;) @Grimson was making a comment to using such an IP range for your internal networks vs using the called for and standard rfc1918 space is pointless.. Such a statement is not making any sort of personal attack.. Its pointing out that your going to shoot yourself in the foot using such a range.. And even called out the fact that it is listed as bogon ;)

As to the current climate of online activity... Some people need freaking stop being 13 year old girls on their first period would be my comment to that ;) Come on people the whole world is not out to get you.. Here is the HARD part about online communication in text - people are HORRIBLE at interpreting tone in text.. So DON'T - take the words at face value.. words to exchange info to HELP YOU!! Using such an IP range is moronic at best... So his phrasing of of don't be an idiot is quite appropriate.. He didn't call you an idiot - he was calling the use of such a range idiotic...

Just kill FTP with 🔥

Well, can you SSH to the tunnel address from the other side? Meaning from the other side's LAN to the other side's tunnel address?

If so, that means sshd is listening on and can receive connections on that address so it should work.

You would want to assign an interface to the OpenVPN instance on the connecting side and set up outbound NAT on OpenVPN for the proper sources to the ssh on the other side.

I don't see any reason that should not work if sshd can receive connections there as described above.

Why do you have 1.2.3.4 identified as floating ip external in one capture and 1.2.3.6 identified as primary CARP IP in the other. What is the difference? What is what?

I would check that MAC addresses on the ping traffic are sourcing from where they should be and not being ping-ponged around out there. I would double-check all netmasks of all the hosts/interfaces out on WAN.

Do this:

Diagnostics > Test Port

Select the destination server, TCP, and a port the destination server is listening on.

Do the test sourcing from the WAN interface address and the WAN CARP VIP. Does it work for both?