Port forward for Steam

natethegreat21

@johnpoz Thank you for your response! I am hosting a game server that other players will connect to so it needs that port open according to them. I have unchecked the "Invert match" box. I have also disabled NAT reflection.I rechecked the a few port checker websites off my phone on cellular and its still saying the ports are closed for some reason.

johnpoz

@natethegreat21 Well lets see your port forwards and your wan rules.

First step is always validate traffic is getting to you - simple packet capture on your wan while you go to say can you see me . org

Here created a port forward for 7779, even though my machine isn't listening on this port, very simple to verify getting to my wan, and being sent on to my lan device.

You can see my port forward and wan rule.

Went to can you see me sent traffic to that port. I can see it on my wan packet capture, and I can see that it sent it on to my lan device on 192.168.9.100 - it sent back a RST.. Saying hey nothing here on that port

natethegreat21

@johnpoz Okay I set everything up like you have in the screen shots and did a packet capture and I see the request coming from the server to the WAN IP and when I check the LAN side nothing is being captured for that port.

johnpoz

@natethegreat21 well then something wrong with your port forward, if your saying when you sniff on the lan, and your not seeing any traffic to that IP you setup your forward to.

But you see it hit your wan IP on that port..

Could be pfsense can not even talk to that IP, pfsense can not send the traffic if there is no mac in the arp table for that IP.

Maybe you have a floating rule that blocking the port forward..

Use the port tester in pfsense.

Here I tested port to IP on my lan, that I know it open.. But I don't forward to it - but you can see pfsense was able to talk to it.

Did you capture on the right lan side interface, do you have this setup on a vlan? Happy to help you but without specific details, just guessing to what you have incorrect or wrong, or would could be stopping it from working.

natethegreat21

@johnpoz the IP is on VLAN 15 and when I tested the port it failed. I have also attached the floating rules which were stup to prevent the VLANs from talking to the firewall

johnpoz

@natethegreat21 well from that test, you know for sure that even if pfsense can talk to that IP - its not listening on that port, or sending a RST.

Can pfsense even ping the IP? Look in the arp table - do you see mac listed for that IP?

natethegreat21

@johnpoz Yes I see the MAC and IP listed. ARP TABLE.PNG

johnpoz

@natethegreat21 well clearly the box is not working on 7779..

So doesn't matter if pfsense port forward working or not, its not going to work if the port is not listening on the port.

You sure that is the IP is your game is running on, look via netstat on the machine and validate 7779 is actually listenging..

For example you can see on my nas that its listening on that 5001 I tested too

ash-4.4# netstat -an | grep :5001
tcp        0      0 0.0.0.0:5001            0.0.0.0:*               LISTEN     
tcp6       0      0 :::5001                 :::*                    LISTEN     
ash-4.4#

netstat works on windows as well

$ netstat -an

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:2008           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:6045           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:28525          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:31111          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING

natethegreat21

@johnpoz So I see the port there under UDP but it does not say its listening for some reason.

johnpoz

@natethegreat21 well if its not listening that would explain why you can not talk to it

But that wouldn't explain why you didn't see it send on the traffic. But until you can see it listening and the port tester validates the port is up and pfsense can talk to it. doesn't matter if your port forward is working or not.

natethegreat21

@johnpoz I looked on the windows machine to see of the ports were listening and they didn't say they were its showed its there but it didn't have the listening next to it. I did notice that I can ping the 192.168.150.1 but not the 192.168.150.3

natethegreat21

@johnpoz I don't usually have this many issue with port forwarding so not really sure what the next step would be at this point. Got any suggestions please?

natethegreat21

@natethegreat21 I will also note that this windows machine is a VM