Port forwarding doesn't work
-
@taylorswift
So you presumably don't get any packets in.
You have to check some things then.Do you have a real public WAN IP on pfSense?
Do you have a router in front of it?Does you provider block access to you?
What is the concrete role of Cloudflare here?
-
I think yes, but i'm not sure (i use pppoe to connect with ISP)
No
No
I don't want to show my IP to website visitors
-
@taylorswift
So you have the pppoe IP on pfSense.Just check your IP by using a web service, e.g. https://www.whatismyip.com.tw and compare it with the pfSense WAN.
If both show equal IPs, you can go on.Then go to a port check service (https://portchecker.co), enter your IP and 443 as port and check if it's open.
If it's open, check your Cloudfare settings, whatever it does...
If the port is closed, go your WAN rules and verify if the port 443 was hit. -
@viragomann said in Port forwarding doesn't work:
Just check your IP by using a web service, e.g. https://www.whatismyip.com.tw and compare it with the pfSense WAN.
If both show equal IPs, you can go on.It's the same.
@viragomann said in Port forwarding doesn't work:
Then go to a port check service (https://portchecker.co), enter your IP and 443 as port and check if it's open.
It's closed.
@viragomann said in Port forwarding doesn't work:
If the port is closed, go your WAN rules and verify if the port 443 was hit.
I don't really understand what I should do. Could you tell more about this?
-
@taylorswift
This shows the current states and the bytes count. You see at least some bytes there.
-
@viragomann
I don't see anything. There are no states on both 80 and 443 port.
-
@taylorswift
I'm not expecting to see any state if the port is shown up as closed.
I was requesting the bytes. -
This post is deleted! -
@viragomann
Still i don't see any bytes, but if blocking rule bytes changed, i think there is something wrong with port forwarding settings
-
@viragomann
If it is helpful i set some settings from this website: https://nguvu.org/pfsense/pfsense-baseline-setup/ -
@taylorswift
If you probed port 443 you should see any bytes on this rule.Since there is nothing, I'd consider to check your Cloudflare settings. I suspect, you have activated it's tunnel or proxy or whatever.
-
@viragomann
I'll check this, but why it shows that the ports are closed on port checker website? -
@taylorswift
I assume, there is no packet arriving on your WAN.You can sniff the WAN traffic with Diagnostic > Packet Capture, while doing a port check, or just try yourself to access your IP from outside by https://<yourIP>.
You should see at least any packet.If not, possibly access is blocked by your ISP.
-
@taylorswift because it go no reply is why it would show closed.. Very first thing you should do in troubleshooting a port forward is go to like can you see me . org.. Put in the port you want, and then sniff on your pfsense wan - do you see this traffic if not, then nothing you do on pfsense is going to get a port forward to work.
If you don't see that traffic hit pfsense via the packet capture under diagnostics - nothing you do on pfsense would ever get a port forward to work.
You might behind another nat device? What is in front of pfsense? Maybe you don't even have a public IP, ie cgnat from your isp and not just a natting device in front. If you have another isp device in front of pfsense you need to forward the traffic to pfsense wan IP so your port forwards on pfsense can work. Your rules not triggering screams the traffic is not getting to pfsense.
if port forwarding didn't work the forums would be a blaze with people complaining - it would be like a ddos attack ;)
-
@johnpoz
There is hope
-
@taylorswift ok that is good sign for sure!!! But maybe your isp blocks 443 and 80.. Do those ports same way.. Many an isp block 443 and 80 because part of their tos is can't run server/services, etc..
But you see traffic on that odd ball port is hope for sure.
-
@johnpoz
I don't understand this... On port 80 the same results, but can you see me has different IP.
-
@taylorswift That is your traffic to and from the website.. You need to look for traffic to your IP on 443 and 80..
Make sure you like set the count of packets to like 0 or it could finish before you even send your traffic. And might be easier if you download and open in wireshark so easier to look for the specific traffic
here is where they sent to me on 443, I answer because I serve up something on 443.. But here you can see where they sent the syn to my public IP, and where I answer with syn,ack
Your going to want to make sure you see a syn to port 443 in your sniff.
-
@johnpoz
I think I've got the point. My isp blocks ports 80 and 443. Tomorrow I'll try to do that on other port, but there might be problem with Let's Encrypt SSL. -
@taylorswift doesn't matter if ssl is broken, doesn't matter if you have anything listening or anything.. If you send traffic to your IP on 443, then you should see it in the packet capture. If not then no port forward would never work.
See my edit from above.
