Why is port 445 blocked?

fmaen

Hey guys,
sorry for a maybe stupid question... I´m new to firewalling :)

For whatever reason, Port 445 is blocked on my pfSense firewall.

My Setup: Windows Client in WAN network with IP 192.168.178.20
WAN is a FritzBox network (will be changed to be a "real" WAN network later when I´ll move the clients in a LAN net)

I have a Synology NAS in another subnet (DEV) with IP 10..0.200.175

From the client, I´m trying to access the Synology SMB share. I can browse the share but data is not transferred, From the logs, I see traffic on port 445 is blocked, even though there is a rule to allow TCP/445.

Log:

Firewall Rule:

Of course this is disabled:

Any ideas?

serbus

Hello!

This is from the docs and might help:

"*Warning

The WAN Net choice for source or destination means the subnet of the WAN interface only. It does not mean “The Internet” or any remote host.*"

John

johnpoz

@fmaen so you disabled nat on pfsense? If your on some rfc1918 network and you want to access some other rfc1918 network behind pfsense..

Either disable natting and allow via firewall rules and route, or you would need to setup port forwarding..

Those blocks are Acks and not Syns - so that is really odd as well..

Maybe you don't actually have isolation of your networks? How exactly are you routing this on your clients on your wan? How would they know how to get to this 10.0.200 network? If you just setup a route on your fritz box that is going to be asymmetrical, etc..

Put your devices behind pfsense now traffic between vlans or other networks is not natted.. All the devices will be using pfsense as their gateway. you won't have to do port forwarding, etc.,

fmaen

@johnpoz YOU ARE MY HERO!

This might be ridiculously stupid but the asymmetrical routing was the reason.

As you may assume from my setup, I once used the FritzBox network only and started to setup the pfSense recently. The Synology NAS was connected directly to the FritzBox (WAN) network on the first eth interface. The second one was connected to the DEV interface of my pfSense where I was facing the described issues.
On the Synology, the first interface was still the WAN subnet connected.

Thanks a lot!!!!