Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Would it be Forwarding or Outbound?

    Scheduled Pinned Locked Moved NAT
    38 Posts 3 Posters 3.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
      last edited by johnpoz

      @o12eMaRkAbLeo well clearly that is not doing static port outbound.. And you killed all the states that were existing before you created that outbound not with static port setting?

      Those settings look right at first glance, thanks for posting the screenshots.. much easier to read..

      Hmmm

      you don't have UPnP enabled do you? What version of pfsense are you on?

      All your traffic from that device should be static port.. Can you make sure all your states were killed and then create outbound stuff to other stuff not just to that 34197 port.. Open some websites or something from something on your 192.168.10 network...

      edit: your firewall rules are loading right when you click apply on that outbound nat setting.. Your hybrid mode I take it.. or I think those mappings wouldn't even be listed.

      Can you look at your rules with

      rules.jpg

      See there is the outbound at rule I created, it shows to my wan address, and has the static-port on it..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      O 2 Replies Last reply Reply Quote 1
      • O
        o12eMaRkAbLeo @johnpoz
        last edited by o12eMaRkAbLeo

        This post is deleted!
        1 Reply Last reply Reply Quote 0
        • O
          o12eMaRkAbLeo @johnpoz
          last edited by o12eMaRkAbLeo

          @johnpoz

          I did have UPnP enabled. Just disabled it.. I really didn't have a need for I just turned it on a while back.

          d4128735-fb74-44fb-9767-91fb12725085-image.png

          States after turning off UPnP
          a90e777c-9c1f-4e51-a11b-9af6b9ae0782-image.png

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
            last edited by johnpoz

            @o12eMaRkAbLeo that is odd..

            edit: wait, I don't see your static nat in your rules when you do the pctrl -sn..

            See mine, vs yours. Where is the static port to your wan like mine when created the static port outbound mapping?

            staticout.jpg

            If the rule is not there, then no it would never static port nat it.. So that would explain why your not seeing the static port nat, the rule isn't there, even though you show it in the gui.

            You flushed all your states? Can you try creating a connection to something completely new like www.yahoo.com or cnn.com - www.msn.com somewhere you don't normally go?

            I can not duplicate your problem here. What version of pfsense are you on?

            Here so for example.. www.msn.com is

            ;www.msn.com.                   IN      A
            
            ;; ANSWER SECTION:
            www.msn.com.            16383   IN      CNAME   www-msn-com.a-0003.a-msedge.net.
            www-msn-com.a-0003.a-msedge.net. 1986 IN CNAME  a-0003.a-msedge.net.
            a-0003.a-msedge.net.    1986    IN      A       204.79.197.203
            

            So if I go there.. and look at my states to that IP, you can see the port leaving the wan has been changed. I close that browser tab and flush the states and create static port rule.. Then go there and now the port is static.

            staticports.jpg

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            O 1 Reply Last reply Reply Quote 0
            • O
              o12eMaRkAbLeo @johnpoz
              last edited by

              @johnpoz

              Is there a way to set the static mapping from the cli?

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                last edited by

                @o12eMaRkAbLeo what I would do is delete your mapping, save. then recreate the mapping save and apply.. then check your rules with the pfctl -sn cmd.. But its never going to do a static mapping if you don't see that in the rules.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                O 1 Reply Last reply Reply Quote 0
                • O
                  o12eMaRkAbLeo @johnpoz
                  last edited by

                  @johnpoz

                  NAT Outbound
                  9937c06c-b558-4cca-8db6-ecbfafe64abb-image.png

                  This is what happened after making these changes.
                  06ea4404-224d-4633-88f9-ff9d3c9b908c-image.png

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                    last edited by

                    @o12eMaRkAbLeo So those clearly are not actually being applied.

                    your in hybrid mode right.. Can you post the full screen of your outbound nat..

                    example here is mine.

                    nat.jpg

                    I pulled out the static port map.. But from what you posted - your static port isn't being applied to the rules for some reason. When you hit apply your not seeing any errors?

                    apply.jpg

                    Your not doing some sort of HA pair with a sync to another pfsense are you?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    O 1 Reply Last reply Reply Quote 1
                    • O
                      o12eMaRkAbLeo @johnpoz
                      last edited by o12eMaRkAbLeo

                      @johnpoz

                      19a3b287-4992-4bb1-8c42-513ad6a78bbb-image.png

                      Here is the Outbound entry
                      6fa45734-5441-4bfa-aa2c-9e3103f305b4-image.png

                      No I have no HA setup just a single instance.

                      Here are my system specs
                      3305f071-3a66-4fbf-8689-fbaf0a0b0dbe-image.png

                      18a77079-45cb-4131-ad65-be7a9054f15d-image.png

                      List of install and running packages
                      052edacc-82e5-4502-8223-bbecca14d3d1-image.png

                      Here is my pcie SFP+ 10gb info
                      c2dbf785-536a-40fb-aa0b-1dfdc573eceb-image.png

                      1 Reply Last reply Reply Quote 0
                      • O
                        o12eMaRkAbLeo
                        last edited by

                        Found this infromation in the rules.debug file.
                        411b043f-e5d2-4592-8ae2-8269547be4ca-image.png

                        Seems like the info is there but just not loading up when it goes through the file.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                          last edited by

                          @o12eMaRkAbLeo so the rules are not actually reloading.. Did you try a force reload? Your not seeing any errors if you click the monitor the reload

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          O 1 Reply Last reply Reply Quote 0
                          • O
                            o12eMaRkAbLeo @johnpoz
                            last edited by

                            @johnpoz

                            How would I go about force reloading?

                            No I am not seeing any errors from the web gui after saving the settings.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                              last edited by johnpoz

                              @o12eMaRkAbLeo said in Would it be Forwarding or Outbound?:

                              force reloading?

                              under status, filter reload, you can then watch the load process, etc.

                              reload.jpg

                              edit: also since know your on 2.7.1 and I am on 23.09 I fired up my 2.7.1 to see if could duplicate your problem.. And works just like it should.. You can no outbound rule.. Then created a rule, and its there when I use pfctl -sn

                              vm71.jpg

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              O 1 Reply Last reply Reply Quote 0
                              • O
                                o12eMaRkAbLeo @johnpoz
                                last edited by

                                @johnpoz

                                Just did a "pfctl -F all" and rebooted. No change.

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                                  last edited by johnpoz

                                  @o12eMaRkAbLeo so your able to add other rules and port forwards.. Can you remove all your port forwards...

                                  Your just not able to create a static port.. So create some sort of other rule just on your lan or wan interfaces.. And they get added when you look at the full rules.

                                  https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

                                  You just can not set a static outbound?

                                  Calling in @stephenw10 maybe he has some idea.. I can not reproduce it that is for sure, not on my 23.09 or my 2.7.1 vm.

                                  edit: example - just created a bogus rule on my lan, and if I look at all my rules with the pfctrl -sr I see that rule added

                                  testryke.jpg

                                  DUDE!!!! You have the rule disabled!!!???

                                  dudejpg.jpg

                                  If you I disable a rule, it goes grey

                                  disable.jpg

                                  But that doesn't show up on yours?? Something is for sure off.. I tried changing my theme to dark and dark-beta, but if I disable the rule it puts a checkmark.. But from your post sure looks like the rule is disabled?? But its not a checkmark and the rule isn't greyed out going to an X, so it should be active.. But its not in your full rule list, which would explain why its not working..

                                  I am really at a loss to what could be going on.. You can created other rules and they show up in the pfctl right? See my test from above.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  O 1 Reply Last reply Reply Quote 0
                                  • O
                                    o12eMaRkAbLeo @johnpoz
                                    last edited by o12eMaRkAbLeo

                                    @johnpoz

                                    No. The rule is not disabled.

                                    But also the new rule that I put on .11 isn't showing up in the pfctl output either.....

                                    c5b2a6d2-12fa-4ea5-b90a-8f6c2b3a54a0-image.png

                                    New rule
                                    9e95da99-ca09-4315-9b96-1c25bbb5e609-image.png

                                    Pfctl -sn output
                                    0be9537e-56cf-46f2-ab63-ecc0225ab064-image.png

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                                      last edited by johnpoz

                                      @o12eMaRkAbLeo no just create a normal rule on some other interface.. The rule doesn't really have to do anything actually, it never has to trigger just want to see if your having this issue with all rules or just outbound nat..

                                      See how I created a dummy rule that would never trigger on my lan because there a any any rule above it.. But when I create it shows up in the rules via the pfctl cmd

                                      Looks like for some reason your not actually in hybrid mode, and only your automatic rules are showing.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      O 1 Reply Last reply Reply Quote 0
                                      • O
                                        o12eMaRkAbLeo @johnpoz
                                        last edited by o12eMaRkAbLeo

                                        @johnpoz

                                        I have already done that I think yesterday.
                                        2487aa69-b374-4afe-8263-6019a890e279-image.png

                                        The .11 isn't showing up in the pfctl -sn output. That is why I decided to build the rule to allow static porting on ipv6 to see if it would show up in the output. It is but still not accepting the static routing.

                                        Assigned another network port to LAN2

                                        14c036a0-518b-4259-a701-48599aa9659c-image.png

                                        pfctl -sn output after changes
                                        b89f22c6-a469-442d-83d5-e8a374099fc7-image.png

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @o12eMaRkAbLeo
                                          last edited by johnpoz

                                          @o12eMaRkAbLeo on your normal lan, just a normal rule - not a outbound nat.. See my above example where I did it on my lan.. Nothing to do with nat.. Just a rule on an interface.

                                          I want to verify its just outbound nat your having a problem with and not writing rules in general..

                                          rule.jpg

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          O 1 Reply Last reply Reply Quote 0
                                          • O
                                            o12eMaRkAbLeo @johnpoz
                                            last edited by

                                            @johnpoz

                                            64aa4ef6-cbff-4e07-a05f-db00339de454-image.png

                                            pfctl -sr | grep Factorio
                                            a0f8e9a4-8284-4d3e-9ffa-5b7751575bbb-image.png

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.