pfSense and meraki z3

[johnpoz]

Lets throw a 3rd one in to my list of pet peeves ;)

Game companies that are unable to correctly document the ports needed for their game to work.. They list ports, but don't say if its inbound or outbound, like 53 - that sure and the F is not needed inbound!! Same with 80... If that was required inbound most people wouldn't be able to play, since most home connections the isp blocks 80 inbound.

How hard would it be to list the ports required outbound, and inbound (port forward) and if any traffic requires static ports..

And a side to that - how about just actually leveraging IPv6 so all this nat shit goes away for your games where the users have IPv6.

[stephenw10]

Yup, and not restricted to games either. I can't tell the number of times I've seen a huge list of forwarded ports that have zero business being there.

Steve

[johnpoz]

I mean really, I create an app that talk to another app via port X.. How about listing these X ports - I mean really you wrote the freaking thing... Are you not using the same internet that everyone else on the planet is using where ports inbound are blocked via nat?

Its just freaking crazy - how F'king hard is that - I mean really!!! Its not like we using different shit here.. Your isp does really the same thing that isp Y does down the street.. Clearly list

Port forward
X
Y
Z

Outbound
A
B
C..

Is that asking that much??

[crs162]

I have one addition to instructions above.

First, thank you all for contributing to this forum. You guys helped me get my Meraki Z3 working with my Pfsense. Wanted to share some additional info, in the hopes it will save somebody else time. To make it work for the Meraki Z3 I got from my company. These servers are owned by my company and apparently we do something special - so just FYI.

Additonal outbound NAT rules for the Meraki to the following destinations:

• UDP to IP:XXX.XXX.XXX.XXX port 50881
• UDP to IP:XXX.XXX.XXX.XXX port 48708

Tally ho!

[pfsauce]

@wyzard said in pfSense and meraki z3:

Thank you everyone for your help! Finally figured what the IP it was getting from my network. Entered a rule with the information and it's working!

Thanks again to everyone for the help and guidance.

Could you please screenshot and post exactly what all you opened to get it working including inbound and outbound? TIA

[stephenw10]

The only thing that was required was an outbound NAT rule for the devices internal IP with static source ports set.

Steve

[pfsauce]

@stephenw10 You're correct, thanks. I just had my port wrong. My port was 50716. I actually also found a few other ports in states, but only needed this one enabled after adding them all.

[beanska]

@crs162 I am struggling with this right now. Could you post your NAT rules?

[stephenw10]

It requires only an outbound NAT rule with static source ports set for connections from the z3.

That could be further limited to only the known destination IPs (if you know them) but it doesn't really matter since there won't be many connections from it.

https://docs.netgate.com/pfsense/en/latest/nat/outbound.html#static-port

Steve

[crs162]

@beanska , or however is still looking for additional info regarding my previous post.

I have two rules, and use aliases to make them apply to ranges of hosts and ports. Replace any 192.168.0.253/32 mentions with your Meraki IP (the IP exposed to Pfsense).

First I made, "Cisco Meraki host alias". This alias contains the destination IP's listed to these ports 7351/9350/9351 that you can find on this page: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity . Make another rule "Cisco Meraki port alias" with those three ports: 7351/9350/9351.

Rule 1: Cisco Meraki ports.
Interface: WAN
Address Family: IPv4+IPv6
Protocol: UDP
Source: Network, 192.168.0.253/32, <no ports defined/blank>
Destination: Network, "Cisco Meraki host alias", "Cisco Meraki port alias"

The second rule will is specific for my company, if you need this, it will be different hosts and ports you need to use. These host addresses are publicly owned by my company and the ports used change every now and then. I've update the ports in this rule 3 times in 1 year. But how I find these ports and hosts is to do a packet capture from PFsense when I power on the Meraki and let it sit for a few minutes, before stopping the capture. Ensure your Meraki is the only device on Pfsense, and look for non response patterns in the log. Excerpt from my capture:

...
05:47:14.880183 IP 192.168.0.253.33621 > 10.214.21.30.40710: UDP, length 102
05:47:14.880188 IP 192.168.0.253.33621 > ###public IP 1###.40710: UDP, length 102
05:47:14.880233 IP 192.168.0.253.33621 > 10.215.136.10.50881: UDP, length 101
05:47:14.880348 IP 192.168.0.253.33621 > ###public IP 2###.50881: UDP, length 101
...

So, that shows we are not getting a reply from requests to these servers (on those ports). That is suspicious. So, I made a rule to allow this. Create aliases for those ports and addresses and create rule 2:

Rule 1: My Company Meraki rule
Interface: WAN
Address Family: IPv4+IPv6
Protocol: UDP
Source: Network, 192.168.0.253/32, <no ports define/blank>
Destination: Network, "My Company Meraki host alias", "My Company Meraki port alias"

This is what has worked for me for a while.

[stephenw10]

Those are static port outbound NAT rules?

They look more like firewall rules but those could never match any traffic on WAN.

Steve

[crs162]

@stephenw10 Those rules are outbound NAT rules. My NAT is set to 'Manual outbound NAT'. And yes, I should have mentioned as well that these are static.

[stephenw10]

Ah, that explains it then,

[johnpoz]

@crs162 said in pfSense and meraki z3:

My NAT is set to 'Manual outbound NAT'

Why if you don't mind me asking.. I never understand why users do this. Not saying there might not be need to do such a thing. But seems most of the time its users following some "vpn" guide that says to do that - when there really is no reason, hybrid nat works just fine for such a thing, etc.

[NollipfSense]

@jknott said in pfSense and meraki z3:

My cable modem is in bridge mode and I can get 2 IPv4 addresses.

This caught my attention...what modem box do you have? Does it have more than one Ethernet port? I would love to have more than one IP's. Did you pay a little more for the second IP?

[crs162]

@johnpoz said in pfSense and meraki z3:

never understand why users do this. Not saying there might not be need to do such a thing. But seems most of the time its users following some "vpn" guide that says to do that - when there really is no r

You are absolutely right, and that exacly what I did. I do not truly understand (hybrid) NAT or maybe most of the buttons I push in Pfsense, but I basically googled: "meraki x3 pfsense connection" and look what random people on the internet say :). I found the vendor documentation not very user friendly - then again my company does not want to deal with individual engineer that has some fancy Pfsense router. They;ll tell me to hook it up directly to my cable modem - and not use personal devices when working. If you have a suggestion, I would not mind trying a simpler better way.