Is ISP blocking all ports?
-
@compprobsolv said in Is ISP blocking all ports?:
their system is blocking most incoming ports when a static IP is used
Wow, that's completely backwards, at least to me. If you're paying for a static IP (don't know if they are or not) you should at least be able to get into your internal network from the outside, using almost any port you need. Strange stuff...
-
@akuma1x
Not really.
Static IP == easier DNS handling - no need to deal with DynDNS.
But why using an static IP if you can't access it ... right, this is strange.
Even openvpn won't work ?Guess @CompProbSolv found himself a new reason to ditch an ISP.
-
@compprobsolv what would be the point of static IP if your inbound is blocked, agree with other comments doesn't make any sense.
Only scenario where it would make sense is if you were sending mail from the ip, and need to be able to set a PTR on the IP, etc. But the common need of a static IP is for inbound traffic.
-
@johnpoz said in Is ISP blocking all ports?:
@compprobsolv what would be the point of static IP if your inbound is blocked
That's the issue exactly. This is the first time I've run into an ISP that blocks many (most) ports on a static IP service.
-
@compprobsolv But they let some through?
-
@gertjan said in Is ISP blocking all ports?:
Even openvpn won't work ?
No. I can't set it up as the packets from the client never make it to the public side of the firewall. I've confirmed that through WireShark, monitoring OpenVPN, and other means.
-
@compprobsolv simple way to see if any traffic is hitting your wan is just packet capture in pfsense. Under diagnostics, you could do an online nmap scan to see what ports are open if any. Or simple shields up over on grc.com while you doing a packet capture would tell you what parts are getting to your wan.
-
@johnpoz said in Is ISP blocking all ports?:
But they let some through?
Yes. I can see packets on port 443, for example, but not on 444 or on 1194. If I do the same test with the dynamic IP, I can see 1194 and just about any other port I try.
I was incorrect when I stated "We tried a simple modem (vs. modem/router) and the problems persisted". Looking at my notes, this ISP (Spectrum) won't allow a modem to be used on their static IP service. It has to be their modem/router which they claim to put in bridged mode to pass everything.
just packet capture in pfsense
I had actually started with that as my test. When I couldn't see the packets arriving, I swapped the firewall out with a computer (using the public IP address on the computer's NIC) and used WireShark to confirm. I'm getting the same results (both successes and failures) with WireShark that I'm getting with the packet capture on the pfSense.
shields up over on grc.com
I believe that I did try this. It has been some months since we move past this project so I'm not certain.
While I appreciate your input, my reason for posting today was to clean up the post and state how I worked around it. We concluded that either we switch to a dynamic IP (which we did, with a standalone modem before the pfSense box) or switch ISPs. The client wasn't ready to switch ISPs at this point. We can work around the dynamic IP well enough.
Thank you again for your comments.
-
@compprobsolv no problem - didn't mean to drag out the thread ;)
I sure you have your fill of the isp nonsense, did you send them your test results showing clearly ports not getting to your device when using the static..
Shame some of these isp can be so clueless sometimes, you for sure would need to escalate this up the support model to level 2 or even level 3 to get someone that has even an idea what your talking about ;)
At least you found a work around, so guess they can save whatever $ they were spending extra for the "static" ;)
-
@johnpoz said in Is ISP blocking all ports?:
did you send them your test results showing clearly ports not getting to your device when using the static
I sent them detailed reports with very specific comments about what did and did not work.
I was told it was escalated to level 2, but never was able to talk to a tech who seemed to have a clue. The common response was "we set up the modem/router correctly, it should work", despite the fact that each tech said that the last one didn't quite get it right.
I never did speak to anyone (or hear second-hand) at the ISP who acknowledged that there really was a problem.
It was all rather frustrating! I finally told my client that I didn't see us getting it resolved with that ISP.
