Unable To Port Forward
-
@exlow see my edit.. Do a simple sniff, this is where I would always start with troubleshooting - because if pfsense never sees the traffic, it is impossible for it to ever forward it. So best to start there.
-
@johnpoz I don't think Pfsense has seen any traffic. I did to what you suggested based on the troubleshoot guide before I made this post. Let me look again a bit closer I am tired and frustrated.
-
@johnpoz So if I'm correct the IP's for https://www.yougetsignal.com are 172.67.138.108 and 104.21.78.236. with that information I ran a packet capture and tested the port. Opened it up in notepad(Finder Tool) and looked for anything with those IPs as well as the port 25565, search came up empty every time.
-
@exlow so for example your port 25565
Be I have a forward or not setup, I would see that traffic if I sniff.. If pfsense does not - then no a forward is never going to work.
You can see from my packet capture on my wan - I saw the attempt to hit that 25565 port, if your not seeing that - then no pfsense could never forward anything, because its not seeing the traffic to be able to forward it.
-
@exlow said in Unable To Port Forward:
I ran a packet capture and tested the port
Where did you run the packet capture - you need to do it under diagnostic menu on pfsense, selecting your wan interface.. If your port forward is not working then no you would never see it on the end client.. You need to validate pfsense sees it on its wan!
You can filter the packet capture for only the port your testing, ie your 25565
If your not filtering traffic on your packet capture for the port your looking for, it could end before you even run your test, because it defaults to only 100 packets..
-
Diagnostics / Packet Capture
Interface: WAN
No other setting selected.
I ran it a 3rd time this time I only searched for 25565. Nothing again.
What now?
-
@johnpoz I didn't see that edit in time. I did get a packet with the port selected. I didn't realize it defaults.
-
@johnpoz The filter rule for this Port Forward is the only thing in the firewall
Unless RFC 1918 and bogon networks mean anything.
Floating is empty
When I sniff the LAN nothing comes up.
The IP I'm using should be correct I've gotten that information from running ipconfig on the source computer. IPv4 Address. . . . . . . . . . . : 192.168.1.19
-
@exlow so your saying you see that port hit your wan.. And you don't see it when you sniff on lan interface and test again.
Ok lets see your wan rules and your port forward.
example here is mine for a port forward
So can you do test for that port from pfsense? example
-
Port Forward as well as WAN and LAN firewall rules should be there.
Also I've seen people make separate rules for UDP and TCP while there is an option to use UDP+TCP. Is there any issue with just using UDP+TCP rather than making 2 rules for them?
I ran "test Port" heres the result
Also heres the result from ipconfig. Just to show the local ip
-
@exlow well not ever going to work, since pfsense can not talk to that IP on that port.. That wouldn't matter what your rules or forwards are..
You need to figure out why that is happening before you worry about your forwarding not working. Service is not listing on the port you think it is? Its not actually running, that device is running a firewall? Its not using pfsense as its gateway.
Can pfsense even ping that IP?
-
@johnpoz I did get a ping on 192.168.1.19, 0% loss. There is a firewall(windows 11) but I have allowed both incoming and outbound traffic for port 25565. "Minecraft" is the name and the rules are at the very top of the first screenshot.
What do you mean by "Service is not listing on the port you think it is?"? I don't follow you on that question.
-
@exlow look on that box with netstat - does it show that port being listened on?
example
That is showing my nas is listening on 32400 on all of its IPs.
Validate your box is actually listening on that port, if it is and your test fails - then your firewall settings are wrong for allowing access. Or maybe its only listening on loopback 127.0.0.1
-
@johnpoz
C:\Users\infin>
I don't think I'm running the right command. But here's what I got from running netstat
-
@exlow use
netstat -an
This will show you listening ports - that is just showing you stuff you have connections too.
the n of that makes sure it shows number for the ports vs service names
-
@johnpoz Thanks for that. Heres all the listening ports.
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING
TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING
TCP 0.0.0.0:10801 0.0.0.0:0 LISTENING
TCP 0.0.0.0:34034 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49671 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49672 0.0.0.0:0 LISTENING
TCP 0.0.0.0:54288 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5939 0.0.0.0:0 LISTENING
TCP 127.0.0.1:6463 0.0.0.0:0 LISTENING
TCP 127.0.0.1:27060 0.0.0.0:0 LISTENING
TCP 192.168.1.19:139 0.0.0.0:0 LISTENING -
@exlow well don't see any 25565 port listening, so no you wouldn't be able to talk to anything on that port.
Is that the full list?
-
@johnpoz futher down I've got this but still not 25565 I ran finder on the whole list, No 25565 at all.
TCP [::]:135 [::]:0 LISTENING
TCP [::]:445 [::]:0 LISTENING
TCP [::]:7680 [::]:0 LISTENING
TCP [::]:10801 [::]:0 LISTENING
TCP [::]:34034 [::]:0 LISTENING
TCP [::]:49664 [::]:0 LISTENING
TCP [::]:49665 [::]:0 LISTENING
TCP [::]:49666 [::]:0 LISTENING
TCP [::]:49667 [::]:0 LISTENING
TCP [::]:49668 [::]:0 LISTENING
TCP [::]:49671 [::]:0 LISTENING
TCP [::]:49672 [::]:0 LISTENING
TCP [::]:54288 [::]:0 LISTENING
TCP [::1]:10801 [::1]:64893 ESTABLISHED
TCP [::1]:49670 [::]:0 LISTENING
TCP [::1]:64893 [::1]:10801 ESTABLISHED -
@exlow yeah your not listening on that port - so no portforward you setup is ever going to work, since the box isn't listening on the port your trying to forward too.
You sure the service that is suppose to listen on that port is actually running?
-
@johnpoz So use a different port?
