Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103)

    Scheduled Pinned Locked Moved NAT
    40 Posts 5 Posters 4.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      learn @johnpoz
      last edited by

      @johnpoz Untitled1.png here what t shows in my log

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @learn
        last edited by Bob.Dig

        @learn 3389 ain't 6060.

        L 1 Reply Last reply Reply Quote 0
        • L
          learn @Bob.Dig
          last edited by

          @bob-dig i changed to do port testing but none worked

          Bob.DigB 1 Reply Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @learn
            last edited by Bob.Dig

            @learn But it is important to test so test again towards 6060 and show the log and don't hide the beginning of those IPs!

            L 1 Reply Last reply Reply Quote 0
            • L
              learn @Bob.Dig
              last edited by

              @bob-dig did what you said it it the same result!

              L 1 Reply Last reply Reply Quote 0
              • L
                learn @learn
                last edited by

                @learn does pfblockerng and openvpn can block portforwarding? im lost here

                johnpozJ GertjanG 2 Replies Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @learn
                  last edited by

                  @learn no those do not block a port forward.

                  As mentioned that block is 3389, your port you forwarded was 6060.. if you are forwarding 6060 to 3389, then you need to hit pfsense wan on 6060, so it can forward it to 3389 on your end device.

                  Your port forward you posted was sending 6060 to 6060.. Not 6060 to 3389.

                  But that has nothing to do with it, your firewall rule allowing 6060 saw no hits, so no your port forward would never work no matter what port you wanted to send to your actual device behind pfsense.

                  If you want to remote desktop to something behind pfsense, and you want to use 6060 on the public internet, then your port forward should be 6060 to 3389, but you need to hit pfsense wan IP on port 6060..

                  On a side note, I would not recommend opening remote desktop to the public internet, be it you change the port or not. If your going to do that, you should make sure you lock down which source IPs can talk to pfsense on that port to be forwarded.

                  The proper way to remote into stuff on your network from the internet, would be to vpn to pfsense from your remote client.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  L 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @learn
                    last edited by Gertjan

                    @learn
                    Take note : when the pfSense NAT rule works, you have to check one last thing :
                    The firewall of the device (PC° where you want to use 3389 = probably MS Remote Desktop.

                    Microsoft, by default, when MS remote desktop is activated, accepts only connections from it's LAN.
                    Example : if your PC has IP 192.168.1.10/24, then connections from any 192.168.1.x/24 are accepted. Others, like an IP from the Internet, are refused.
                    Solution : adapt the related Windows incoming firewall rule - or make your own rule.

                    Again : just be ready to check and correct if needed.

                    edit : as said above : Microsoft has warned their OS users that MS remote desktop should not be used over public networks.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • L
                      learn @johnpoz
                      last edited by

                      @johnpoz thank you so much for your help can you please show me the ideal way to port forward 6060 to 3389

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @learn
                        last edited by johnpoz

                        @learn the ideal way would not be a port forward, and use a vpn. Unless you know the specific source IP you would be coming from and only allow it, opening up remote desktop to the public internet is not a good idea, even if you change the port.

                        But to forward port 6060 to 3389 is simple in your port forward just change the destination port to 3389

                        portforward.jpg

                        But again if your port on the public side is 6060, then for your rule to work no matter what port you send it to, you have to hit pfsense on that port. Your firewall rule you posted never showed any traffic to port 6060, the states column was 0/0

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        L 1 Reply Last reply Reply Quote 0
                        • L
                          learn @johnpoz
                          last edited by

                          @johnpoz sorry for any inconvenience but nothing seems to be working

                          GertjanG J johnpozJ 3 Replies Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @learn
                            last edited by Gertjan

                            @learn

                            Like johnpoz, I created a NAT rule :

                            1929d98a-be62-4fe2-aa09-5a22cbdb5a7a-image.png

                            which creates a WAN pass firewall rule :

                            3903b186-ce1c-4706-bfba-7028882433c4-image.png

                            Note the IP 192.168.1.4 : an old 2008R2 Microsoft server - it has MSRDP activated on port 3389.

                            The firewall counter in front of the rule show traffic.
                            @home, I used a.b.c.d:6060 as the destination where a.b.c.d is my WAN IP, where the 2008R2 server lives (@work).

                            I could access the remote desktop from my 2008R2 server just fine.

                            The creation of the NAT rule :

                            83d517b9-8d23-46a8-9f5e-55318051720d-image.png

                            and I moved the related WAN firewall rule at the top, before the block rules (if any) - and save + apply.

                            Behind the screens, I had also to "NAT" my ISP router which is placed in front of pfSense, where I NAT port 6060 TCP to port 6060, to 192.168.10.3, my pfSEnse WAN IP.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            L 1 Reply Last reply Reply Quote 0
                            • J
                              Jarhead @learn
                              last edited by

                              @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                              @johnpoz sorry for any inconvenience but nothing seems to be working

                              If you aren't using the default port (3389), you'd have to add the port to the ip in the remote desktop connection.
                              Are you doing that?
                              rdp.png

                              1 Reply Last reply Reply Quote 1
                              • L
                                learn @Gertjan
                                last edited by

                                @gertjan brother i have the same configuration as you did the only thing that im not doing is

                                @gertjan said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                Behind the screens, I had also to "NAT" my ISP router which is placed in front of pfSense, where I NAT port 6060 TCP to port 6060, to 192.168.10.3, my pfSEnse WAN IP.

                                is this .

                                i will try to do this and see if it'll works thank you so much for your patience and help

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @learn
                                  last edited by

                                  @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                  for any inconvenience but nothing seems to be working

                                  Well not sure what you expect to work if you never actually hit your pfsense on the port your trying to forward..

                                  Pfsense can not forward what it doesn't see. As you port forward of port 6060 firewall shown any hits, or does it still show 0/0 B for the states?

                                  If you forwarded 6060 on your isp router, and you are not seeing that hit your pfsense wan then maybe your isp port forward is wrong. But clear you see 3389 hit your pfsense..

                                  I can not tell what destination IP is in your deny log to 3389.. if it was rfc1918 ie 192.168 something why did you both hiding it? How is it that 3389 is getting to pfsense wan, but not 6060..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  L 1 Reply Last reply Reply Quote 0
                                  • L
                                    learn @johnpoz
                                    last edited by

                                    @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                    If you forwarded 6060 on your isp router

                                    i didn't do this

                                    @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                    what destination IP is in your deny log to 3389

                                    my wan address
                                    source is the wan address of another pfsense's wan

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @learn
                                      last edited by

                                      @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                      is this .
                                      i will try to do this and see if it'll works

                                      If you have an upstream router, it's not a question of 'trying'. It has to be done.
                                      Otherwise, as johnpoz keeps telling you : traffic can not reach (the WAN interface of) pfSense ....

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      L 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @learn
                                        last edited by johnpoz

                                        @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                        i didn't do this

                                        Well if your pfsense wan is behind a nat, and you didn't forward the port on your upstream router - how would it ever work.. Did you put pfsense wan IP into your upstream router into a dmz host setting or something.

                                        edit: Maybe I confused posts.. Is your pfsense wan IP a public IP or rfc1918?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        GertjanG 1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan @johnpoz
                                          last edited by

                                          @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                          Is your pfsense wan IP a public IP or rfc1918?

                                          We were not allowed to know this :

                                          f3d71c0f-39e0-41f1-8361-ce16a56a64b8-image.png

                                          😊

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          johnpozJ 1 Reply Last reply Reply Quote 2
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @Gertjan
                                            last edited by

                                            @gertjan exactly ;)

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            L 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.