Port Forward does not work..
-
@johnpoz said in Port Forward does not work..:
@root1ng so that is good its listening - so firewall is running, its not answering for some other reason, its sending return traffic elsewhere?
So fire up wireshark or tcpdump and validate the traffic is getting there..
Pfsense did its thing, clearly it sent the traffic.. It has no control to if it gets an answer or not.. Which from your packet captures it did not.
edit: Oh wait - why does it not show Listen as state?
edit2: my bad - its UDP ;) having a brain fart this morning that we dealing with UDP ;) sorry..
I don't know why he doesn't listen, I don't have a firewall on neither on the virtual machine nor on Proxmox, I don't know what else to do... the situation is too complicated...
-
@root1ng see my edit, sorry about that - udp with netstat wouldn't show "listen" state.. like tcp does.. but you can see its listening.
-
@johnpoz said in Port Forward does not work..:
@root1ng see my edit, sorry about that - udp with netstat wouldn't show "listen" state.. like tcp does.. but you can see its listening.
I don't really have anything to check on the device, everything is default, firewall off, the firewall for that virtual machine is off from Proxmox, I don't know what else to check and how..
-
@root1ng on the VM install tcpdump.. sniff with that, depending on the distro you installed might be already installed.
You can set filters on it so only looking for your udp 9987 port.
-
@johnpoz said in Port Forward does not work..:
@root1ng on the VM install tcpdump.. sniff with that, depending on the distro you installed might be already installed.
You can set filters on it so only looking for your udp 9987 port.
That's about all it shows, nothing more, it's just me connected from a local PC (172.16.1.5)
-
@root1ng In Proxmox you have a Firewall Option for every VM and every vNIC. Have you checked both?
-
@Bob-Dig said in Port Forward does not work..:
@root1ng In Proxmox you have a Firewall Option for every VM and every vNIC. Have you checked both?
Hey,
VM Firewall:
login-to-view
NIC Firewall:
login-to-viewWhat I want to add is that, even with Firewall ON or OFF on the NIC, I still can't connect, I tried all the possible options, but without result.
The firewall is not active on all virtual machines, including the main node. -
@root1ng Disable this checkbox on all the VM NICs, on your pfSense and your Linux Server.
I am running TS on a Linux VM (Debian) behind a pfSense VM on Proxmox too, it is running fine for me, just checked.
-
@Bob-Dig said in Port Forward does not work..:
@root1ng Disable this checkbox on all the VM NICs, on your pfSense and your Linux Server.
I am running TS on a Linux VM (Debian) behind a pfSense VM on Proxmox too, it is running fine for me, just checked.
Deactivated but without result..
edit: And I gave a restart to be sure of both
-
@root1ng Maybe the host firewall, what Linux are you using exactly?
Maybe a routing problem, you could show us your proxmox network.In the beginning you had no hits at all on your rules. Have you fixed something or is your testing flawed otherwise? Send me your IP, I will check if I can connect.
Also show your rules on that VMs LAN.
-
@Bob-Dig said in Port Forward does not work..:
@root1ng Maybe the host firewall, what Linux are you using exactly?
Maybe a routing problem, you could show us your proxmox network.In the beginning you had no hits at all on your rules. Have you fixed something or is your testing flawed otherwise? Send me your IP, I will check if I can connect.
Also show your rules on that VMs LAN.
Datacenter, Node and all VMs firewalls are disabled;
I am using Ubuntu Server Pro 22.04.03;
Proxmox network attached:
login-to-view
The idea is that traffic appears in pfSense to the rules in the firewall, but only when I check the ports.
My IP sent privately in dm.TeamSpeak3 Server VM Networking:
login-to-view -
@root1ng Why is Firewall still checked? Disable it. Also show your pfSense LAN rules for that Linux VM.
-
@Bob-Dig said in Port Forward does not work..:
@root1ng Why is Firewall still checked? Disable it. Also show your pfSense LAN rules for that Linux VM.
I told you that I deactivated them earlier and I deactivate them for nothing. Nothing happens
-
@root1ng It looks like your linux VM is in the Management network?
-
@Bob-Dig said in Port Forward does not work..:
@root1ng Why is Firewall still checked? Disable it. Also show your pfSense LAN rules for that Linux VM.
This is what you are talking about?
login-to-view -
@root1ng Yep, that is good.
-
@root1ng if your not seeing the test from the outside on your .6 box, but your seeing it from your local .5 box.. When clearly pfsense sent the traffic on.. then you have something filtering it..
Even if the firewall on the vm was filtering it from the application, the sniff should still show it.
Pfsense has no job other to send the traffic to the IP you say to send it too - it has no control after it puts the traffic on the wire.. Clearly its putting it on the wire from your sniff. If your not seeing it at the end device. Is its sending it to the correct mac, have to assume so since you say that other 33 port is working.
Even had some firewall blocking it on pfsense on outbound direction, on your lan - the sniff you show on the lan side interface showing it was sent wouldn't show that if you had say a floating rule blocking it in the outbound connection..
You have something preventing the 9987 from getting to your VM, if you sniff and see pfsense put it on the wire, but your VM never sees it. Even if the vm wasn't listening or had a firewall blocking it.. The sniff should show that that traffic got there. So maybe you have something in your VM host preventing from sending it on to the VM, or sending it to the wrong vm.. Or something else filtering traffic from getting there - acl on a switch? Something in wifi if that is in use..
But if pfsense put it on the wire, pfsense job is done.. There is nothing else for pfsense to do..
-
@johnpoz Yeah, I could even connect to it, only OP can't do it to the public IP.
-
@Bob-Dig I know longer have my proxmox box to play with, so I can not test anything with proxmox.. But from what he shows pfsense put the traffic on the wire - if the destination is not getting it, that nothing to do with pfsense.
I would sniff on proxmox host to validate the traffic gets to it.. Then you for sure would know that its proxmox where the problem is.
edit: I even validated if you have a floating rule outbound to block it, would pfsense sniff maybe show going out the wire, even though it really wasn't
And when I block it with an outbound floating rule on the lan, the sniff never shows it going anywhere.. So it can't even be something like that.. Because he shows a sniff on pfsense sending on the traffic
-
@johnpoz said in Port Forward does not work..:
@Bob-Dig I know longer have my proxmox box to play with, so I can not test anything with proxmox.. But from what he shows pfsense put the traffic on the wire - if the destination is not getting it, that nothing to do with pfsense.
I would sniff on proxmox host to validate the traffic gets to it.. Then you for sure would know that its proxmox where the problem is.
edit: I even validated if you have a floating rule outbound to block it, would pfsense sniff maybe show going out the wire, even though it really wasn't
And when I block it with an outbound floating rule on the lan, the sniff never shows it going anywhere.. So it can't even be something like that.. Because he shows a sniff on pfsense sending on the traffic
Yes, it seems that from outside the network I can connect with the public IP, from inside the network (WiFi or Cable) I can't connect at all with the public address..
I don't understand what I have to check with Proxmox, because everything is default and I have nothing to change.