Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103)

    Scheduled Pinned Locked Moved NAT
    40 Posts 5 Posters 5.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan @learn
      last edited by Gertjan

      @learn

      Like johnpoz, I created a NAT rule :

      1929d98a-be62-4fe2-aa09-5a22cbdb5a7a-image.png

      which creates a WAN pass firewall rule :

      3903b186-ce1c-4706-bfba-7028882433c4-image.png

      Note the IP 192.168.1.4 : an old 2008R2 Microsoft server - it has MSRDP activated on port 3389.

      The firewall counter in front of the rule show traffic.
      @home, I used a.b.c.d:6060 as the destination where a.b.c.d is my WAN IP, where the 2008R2 server lives (@work).

      I could access the remote desktop from my 2008R2 server just fine.

      The creation of the NAT rule :

      83d517b9-8d23-46a8-9f5e-55318051720d-image.png

      and I moved the related WAN firewall rule at the top, before the block rules (if any) - and save + apply.

      Behind the screens, I had also to "NAT" my ISP router which is placed in front of pfSense, where I NAT port 6060 TCP to port 6060, to 192.168.10.3, my pfSEnse WAN IP.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      L 1 Reply Last reply Reply Quote 0
      • J
        Jarhead @learn
        last edited by

        @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

        @johnpoz sorry for any inconvenience but nothing seems to be working

        If you aren't using the default port (3389), you'd have to add the port to the ip in the remote desktop connection.
        Are you doing that?
        rdp.png

        1 Reply Last reply Reply Quote 1
        • L
          learn @Gertjan
          last edited by

          @gertjan brother i have the same configuration as you did the only thing that im not doing is

          @gertjan said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

          Behind the screens, I had also to "NAT" my ISP router which is placed in front of pfSense, where I NAT port 6060 TCP to port 6060, to 192.168.10.3, my pfSEnse WAN IP.

          is this .

          i will try to do this and see if it'll works thank you so much for your patience and help

          GertjanG 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @learn
            last edited by

            @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

            for any inconvenience but nothing seems to be working

            Well not sure what you expect to work if you never actually hit your pfsense on the port your trying to forward..

            Pfsense can not forward what it doesn't see. As you port forward of port 6060 firewall shown any hits, or does it still show 0/0 B for the states?

            If you forwarded 6060 on your isp router, and you are not seeing that hit your pfsense wan then maybe your isp port forward is wrong. But clear you see 3389 hit your pfsense..

            I can not tell what destination IP is in your deny log to 3389.. if it was rfc1918 ie 192.168 something why did you both hiding it? How is it that 3389 is getting to pfsense wan, but not 6060..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            L 1 Reply Last reply Reply Quote 0
            • L
              learn @johnpoz
              last edited by

              @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

              If you forwarded 6060 on your isp router

              i didn't do this

              @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

              what destination IP is in your deny log to 3389

              my wan address
              source is the wan address of another pfsense's wan

              johnpozJ 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @learn
                last edited by

                @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                is this .
                i will try to do this and see if it'll works

                If you have an upstream router, it's not a question of 'trying'. It has to be done.
                Otherwise, as johnpoz keeps telling you : traffic can not reach (the WAN interface of) pfSense ....

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                L 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @learn
                  last edited by johnpoz

                  @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                  i didn't do this

                  Well if your pfsense wan is behind a nat, and you didn't forward the port on your upstream router - how would it ever work.. Did you put pfsense wan IP into your upstream router into a dmz host setting or something.

                  edit: Maybe I confused posts.. Is your pfsense wan IP a public IP or rfc1918?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @johnpoz
                    last edited by

                    @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                    Is your pfsense wan IP a public IP or rfc1918?

                    We were not allowed to know this :

                    f3d71c0f-39e0-41f1-8361-ce16a56a64b8-image.png

                    😊

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    johnpozJ 1 Reply Last reply Reply Quote 2
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Gertjan
                      last edited by

                      @gertjan exactly ;)

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      L 1 Reply Last reply Reply Quote 0
                      • L
                        learn @johnpoz
                        last edited by

                        @johnpoz it is a public address that's why i highkited it sorry

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @learn
                          last edited by johnpoz

                          @learn so have you managed to actually get traffic to hit your 6060 forward?

                          Or does your rule still show the 0/0 in the states column on your wan rule?

                          Nothing is ever going to work until you actually get traffic to pfsense for it to forward. Once it hits pfsense and you send it to the device behind pfsense IP on port 3389... You also need to make sure this device firewall allows traffic from a remote IP.. Out of the box windows firewall is sure not going to allow some remote IP to hit it on rdp.

                          edit: Here I just sent port 6060 to my pc 3389..

                          forward.jpg

                          Notice that my test from outside shows success, and if I look on the state table in pfsense information has been exchanged.. My firewall on my pc on 192.168.9.100 allows this, and its using pfsense as its gateway.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • L
                            learn @Gertjan
                            last edited by

                            @gertjan said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                            upstream route

                            i doubled checked and no i don't

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @learn
                              last edited by johnpoz

                              @learn well if your not seeing traffic hit your pfsense wan IP on 6060, and your trying for forward traffic that hits your pfsense wan on 6060 to 3389.. How would it ever work.. Pfsense can not forward traffic it never sees..

                              Your sure the remote client is actually trying to connect on port 6060?? Your sure the remote site allows 6060 outbound?

                              Simple test.. Got to can you see me . org, set the port to 6060.. Do you see your rule states change from 0/0 ? Do a sniff on your wan while you do this test.. Do you see the traffic hit pfsense wan?

                              edit: here I turned off the port forward I had setup.. But a simple 10 second test can validate that traffic is hitting pfsense wan on port 6060

                              sniff.jpg

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • L
                                learn
                                last edited by

                                @johnpoz how show me im lost and brain fogged

                                @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                Got to can you see me . org, set the port to 6060.

                                shows me failed connection timeout

                                @johnpoz said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                Pfsense can not forward traffic it never sees

                                it sees my packet coming but deny it with default rule i don't where i missed up

                                your picture of canyouseeme is my state rightnow whither the it is enabled or disabled
                                the only port that gives me green(port-test) is my lan address which im trying to to remote access with 3389 port if this helps!

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @learn
                                  last edited by johnpoz

                                  @learn said in pfsense port forwarding/ WAN Default deny rule IPv4 (1000000103):

                                  remote access with 3389 port if this helps!

                                  No that doesn't help..

                                  So setup a sniff on your pfsense wan for port 6060.. Packet capture under diag menu on pfsense. Now do the canyouseeme test.. Do you see the traffic in your sniff? If not then nothing you do on pfsense is going to get it to work.

                                  Again pfsense can not forward traffic it never sees..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.