Unable To Port Forward
-
https://imgur.com/a/OO1EJB9
-
-
@kom
I've read through both those articles, The only thing that draws my attention on that list is the Advanced outbound NAT. The entry I've setup hasn't work but I am in unfamiliar territory. Maybe I've input something incorrectly? -
@exlow that is an outbound nat, that is not what you would do in a port forward to something behind pfsense being accessed by someone on the internet
No outbound nat would need to be done for a port forward.
Follow the troubleshooting details give in the links by @KOM
First thing I always suggest is actually validate traffic is getting to your wan (public IP).. Do a packet capture under diagnostic menu (sniff)
When you go to a test site like can you see me . org, and put in that port - do you see the traffic actually hit your wan interface. If not no matter what you do on pfsense is never going to get it to work..
If you see it hitting your wan in the packet capture. What other rules do you have on wan, maybe something blocking before it gets to your allow rule for the port forward. Do you have something in floating tab that could be blocking it?
If you don't see any problems - and your seeing it on wan, then sniff on your lan side interface when you do the test.. Do you see it send the traffic on to the correct IP. If you do then something downstream of pfsense preventing it, most likely firewall on the device your trying to forward too, or that device isn't using pfsense for gateway, the service that is suppose to be listening on that port isn't? Or you have the wrong IP your trying to forward too, etc.
Its pretty much all laid out in the links provided on how to find the issue. It really should take only a couple of minutes to find out what the issue is.
-
@johnpoz Thats kind of what I figured. Everything else on those lists either wasn't compatible or I knew for a fact was correct (I've got a pea sized brain alright). The configuration I've got is Modem>Pfsense>Switch The only other idea I've got is my ISP blocking the connection. I've never had that issue and I've been able to open the port before on other routers.
-
@exlow see my edit.. Do a simple sniff, this is where I would always start with troubleshooting - because if pfsense never sees the traffic, it is impossible for it to ever forward it. So best to start there.
-
@johnpoz I don't think Pfsense has seen any traffic. I did to what you suggested based on the troubleshoot guide before I made this post. Let me look again a bit closer I am tired and frustrated.
-
@johnpoz So if I'm correct the IP's for https://www.yougetsignal.com are 172.67.138.108 and 104.21.78.236. with that information I ran a packet capture and tested the port. Opened it up in notepad(Finder Tool) and looked for anything with those IPs as well as the port 25565, search came up empty every time.
-
@exlow so for example your port 25565
Be I have a forward or not setup, I would see that traffic if I sniff.. If pfsense does not - then no a forward is never going to work.
You can see from my packet capture on my wan - I saw the attempt to hit that 25565 port, if your not seeing that - then no pfsense could never forward anything, because its not seeing the traffic to be able to forward it.
-
@exlow said in Unable To Port Forward:
I ran a packet capture and tested the port
Where did you run the packet capture - you need to do it under diagnostic menu on pfsense, selecting your wan interface.. If your port forward is not working then no you would never see it on the end client.. You need to validate pfsense sees it on its wan!
You can filter the packet capture for only the port your testing, ie your 25565
If your not filtering traffic on your packet capture for the port your looking for, it could end before you even run your test, because it defaults to only 100 packets..
-
Diagnostics / Packet Capture
Interface: WAN
No other setting selected.
I ran it a 3rd time this time I only searched for 25565. Nothing again.
What now?
-
@johnpoz I didn't see that edit in time. I did get a packet with the port selected. I didn't realize it defaults.
-
@johnpoz The filter rule for this Port Forward is the only thing in the firewall
Unless RFC 1918 and bogon networks mean anything.
Floating is empty
When I sniff the LAN nothing comes up.
The IP I'm using should be correct I've gotten that information from running ipconfig on the source computer. IPv4 Address. . . . . . . . . . . : 192.168.1.19
-
@exlow so your saying you see that port hit your wan.. And you don't see it when you sniff on lan interface and test again.
Ok lets see your wan rules and your port forward.
example here is mine for a port forward
login-to-viewSo can you do test for that port from pfsense? example
-
Port Forward as well as WAN and LAN firewall rules should be there.
Also I've seen people make separate rules for UDP and TCP while there is an option to use UDP+TCP. Is there any issue with just using UDP+TCP rather than making 2 rules for them?
I ran "test Port" heres the result
Also heres the result from ipconfig. Just to show the local ip
-
@exlow well not ever going to work, since pfsense can not talk to that IP on that port.. That wouldn't matter what your rules or forwards are..
You need to figure out why that is happening before you worry about your forwarding not working. Service is not listing on the port you think it is? Its not actually running, that device is running a firewall? Its not using pfsense as its gateway.
Can pfsense even ping that IP?
-
@johnpoz I did get a ping on 192.168.1.19, 0% loss. There is a firewall(windows 11) but I have allowed both incoming and outbound traffic for port 25565. "Minecraft" is the name and the rules are at the very top of the first screenshot.
What do you mean by "Service is not listing on the port you think it is?"? I don't follow you on that question.
-
@exlow look on that box with netstat - does it show that port being listened on?
example
That is showing my nas is listening on 32400 on all of its IPs.
Validate your box is actually listening on that port, if it is and your test fails - then your firewall settings are wrong for allowing access. Or maybe its only listening on loopback 127.0.0.1
-
@johnpoz
C:\Users\infin>
I don't think I'm running the right command. But here's what I got from running netstat
-
@exlow use
netstat -an
This will show you listening ports - that is just showing you stuff you have connections too.
the n of that makes sure it shows number for the ports vs service names
