NAT rule for peer port
-
Hi,
I try to open port 51413 and forward it to my local peer-to-peer machine (192.168.100.6), and it seems i'm not smart enough.
I tried to follow the NAT documentation, but i can't figure out the issue. After way too much time browsing the documentation and the forum, here is my (non working) configuration. I'm pretty sure i'm missing something obvious and maybe one of you will be able to help ?
Thank in advance,
-
@mathieur you currently show 81 states using that port forward.. If something is not working, its not the port forward.
On a side note - opening up your webgui to the public internet, not very secure setup..
-
@johnpoz thanks for the reply. The web gui is not open, i think your refering to the 80 and 443 rules ? that's for HAproxy.
The port still "look" closed from the p2p app perspective, any idea what might be wrong ?
-
@mathieur good to hear that is your haproxy..
I just checked the IP you talk to the forum on, and I show that port open
I would uncheck that ask for UPnP checkbox when you check - if your not running UPnP on pfsense, maybe it thinks its closed because it can't open it via UPnP?
But if I send a syn, I get a syn,ack back..
Do you have any rules in floating that might block Ips from regions of the world, maybe where that test comes from?
-
@johnpoz Thanks for your help !
Rules from pfBlockerNG in floating was indeed the origin. I would never have guessed by myself
-
@mathieur geo filtering for something like a p2p prob not a good thing ;) hehehe
You really have no clue to where traffic might come from.. I had sim sort of problem when I started filtering based on geoip and a test plex does for if your plex is available remote.. Some of the testing comes from non US ips, same goes for stuff like uptime robot and status cake.. They leverage global resources to check stuff, and if your filtering to only allow IPs from certain regions you can run into issues.
I just found where these services list what IPs can be used as source of the traffic, and allowed them - the lists of IPs do change now and then.. And just added them to my pfblocker alias that I use to allow.
But with something like p2p, that would be pretty impossible..
