Port forwarding not working properly
-
@stephenw10 said in Port forwarding not working properly:
@yon-0 said in Port forwarding not working properly:
10.10.2.1
Do you see states/traffic on that pass rule?
Do you have pass rules on the WireGuard group interface? That would prevent the reply-to being applied.
-
@stephenw10 said in Port forwarding not working properly:
Do you see states/traffic on that pass rule?
no, No traffic shows up on wg forwarding port
-
Ok, so no traffic is hitting those rules. Most likely it's being passed on the WG group interface. If that is the case then reply-to would not be applied.
What rules do you have on the WG group?
-
@stephenw10 said in Port forwarding not working properly:
Ok, so no traffic is hitting those rules. Most likely it's being passed on the WG group interface. If that is the case then reply-to would not be applied.
What rules do you have on the WG group?
-
because wg0 has setup to pfsense default gateway, so wg0 is normal, other wireguard tunnel can't work.
-
You have to pass that traffic on the assigned interface tabs and not on the Wireguard group tab otherwise reply-to cannot work.
So disable the rules on the group tab.
-
i will try it...
-
i have been deleted all wg group rule, and add rule to each wg . but it still can't work.
-
Do you see states/traffic on the assigned interface tabs now?
-
no, i can't it.
-
The firewall rules have been delayed for too long. Now I can test a port 25. Let me test the others.
-
I have a question, if I have ipv6 bgp, should ipv6 use group rules or per-interface rules? of cause ipv6 no need port farwarding. Does it affect multiple routing exports?
-
With IPv6 there would usually only be one route, defined by BGP, since there is no NAT. I would not expect there to be any policy based routing.
-
@stephenw10 So what you mean is that you ipv6 only need to set up group firewall rules? Do I understand correctly?
-
That's what I would expect because the system routing table should be correct. Incoming traffic should always come from that route unless you have some route asymmetry somehow.
It's the port forwards (NAT) that allows traffic from a single source IP to arrive via any gateway.
