Cannot PF/NAT to save my life...
-
I've been struggling with this on and off for literally a couple years now.
I can't seem to reliably get pfsense to let me open up any ports to the outside world, for any of the various things I've tried. Ultimately, I've always ended up just giving up and moving on to other things, but now I'm determined to get this sorted. lol
At the moment, I'm trying to set up RustDesk as a self-hosted service on my unraid server (in a docker), and it needs ports 21115-21119 TCP and port 21116 UDP to be accessible from outside.
That should be fairly simple, according to the Netgate NAT article. Yes, I actually read the docs! :)
However, after creating the rules, the ports still report as unreachable on canyouseeme.org and via a powershell query.
I've attached an image of my NAT rule. What else do fine folks need to see in order to tell me what I've done wrong?
I'm on DSL internet, if that matters any.!
cap 001.JPG -
@Elmojo said in Cannot PF/NAT to save my life...:
However, after creating the rules, the ports still report as unreachable on canyouseeme.org and via a powershell query.
Consider that this also requires that the destination machine accept the access. It could block it by its own firewall.
I've attached an image of my NAT rule.
This is just the filter rule.
Also ensure that your WAN address is even reachable from the outside world.
Do you have a real public IPv4 or an IPv6. -
@viragomann Thanks so much for the quick reply!
Unfortunately, I'm not sure I understand your answers...@viragomann said in Cannot PF/NAT to save my life...:
Consider that this also requires that the destination machine accept the access. It could block it by its own firewall.
There is no destination machine yet. At the moment, I'm just using the web services to check if the ports are open. Do you mean my local server? If so, then it has no separate firewall, that I'm aware of. It's unraid. The service I'm trying to access is running within a docker container. It should be listening on those ports, but I don't know what is supposed to happen when you ping them. However, the docs for RustDesk say to check that the ports are open using the tools I noted above before proceeding, so I suspect that method should work.
@viragomann said in Cannot PF/NAT to save my life...:
This is just the filter rule.
Also ensure that your WAN address is even reachable from the outside world.
Do you have a real public IPv4 or an IPv6.I'm not sure what you mean here, sorry. How would I check that? It could easily be the issue. I have a crappy DSL ISP, that changes my IP all the time. I do know what my public IP is, if that's what you mean.
-
@Elmojo said in Cannot PF/NAT to save my life...:
There is no destination machine yet. At the moment, I'm just using the web services to check if the ports are open.
If there is no service listening on the forwarded port behind pfSense or the access is blocked anywhere else, the port checker will display it as closed.
Do you have a real public IPv4 or an IPv6.I'm not sure what you mean here, sorry. How would I check that?
You should know, how you try to access your service from outside. I sadly can't if you're not telling me.
It could easily be the issue. I have a crappy DSL ISP, that changes my IP all the time. I do know what my public IP is, if that's what you mean.
So is it a public or a private??
-
@viragomann said in Cannot PF/NAT to save my life...:
If there is no service listening on the forwarded port behind pfSense or the access is blocked anywhere else, the port checker will display it as closed.
There is a service listening on those ports. The RustDesk container is running on my server, and it says it uses those ports. If they are being blocked by some other method (other than pfsense), I would have no way of knowing. How would I investigate that?
@viragomann said in Cannot PF/NAT to save my life...:
So is it a public or a private??
My IP is public, I believe. It's not static, and is subject to change whenever my router reboots, or if my ISP feels like it, if that makes any difference.
-
@Elmojo said in Cannot PF/NAT to save my life...:
So is it a public or a private??
My IP is public, I believe. It's not static, and is subject to change whenever my router reboots, or if my ISP feels like it, if that makes any difference.
Private in this case would mean that you are on the ISP's internal IP range and you are behind their FW and NAT. If you look at the IP that pfsense is listing under Interfaces - WAN, and compare to what https://www.whatismyip.com/ reports. Are they the same or different?
If different, you are NATed and will not be able to reach your servers from the outside in the simple way you intended.
Your option then is to call up the ISP and ask for a public IP, or use a VPN service that works for this type of setup. -
@Gblenn said in Cannot PF/NAT to save my life...:
If you look at the IP that pfsense is listing under Interfaces - WAN
No IP is shown on that screen, it just says "IPv4 Configuration Type: DHCP"
However, if I look at the pfsense dashboard, at the section under 'Gateways" and compare that to whatismyIP.com, I see that I'm getting different IPs. Is that what you mean?
If so, then it appears I'm NAT'd.
That would explain why none of the services I've tried to set up over the years have worked properly. I just can't imagine why no one has had me do this simple check!
-
@Elmojo said in Cannot PF/NAT to save my life...:
I see that I'm getting different IPs. Is that what you mean?
Exactly. This is, what I tried hard to find out without success.
If you say "it's public, not private" you should know, what's the difference. Otherwise you should ask, how to determine.
-
@viragomann I'm very sorry, but I have extreme difficulty understanding you. I appreciate you trying to help, though. Thanks!
-
@Elmojo said in Cannot PF/NAT to save my life...:
@Gblenn said in Cannot PF/NAT to save my life...:
If you look at the IP that pfsense is listing under Interfaces - WAN
No IP is shown on that screen, it just says "IPv4 Configuration Type: DHCP"
However, if I look at the pfsense dashboard, at the section under 'Gateways" and compare that to whatismyIP.com, I see that I'm getting different IPs. Is that what you mean?
If so, then it appears I'm NAT'd.
That would explain why none of the services I've tried to set up over the years have worked properly. I just can't imagine why no one has had me do this simple check!Yes unfortunately it would appear that you are NATed.
But there are ways to solve this, and the first thing would be to call your ISP and say that you want a public IP. Not that they should require a reason for it but how about you need to access your security cameras for example...
Depending on ISP, they may ask for a fee, which I think is outrageous, but some do. Anyway, if that is the case, and it feels like it will be too costly, I'd look at setting up a VPN instead. I believe there are free versions that should work, but it can't just be any VPN. It has to be someone that will provide your own IP at the "end of the tunnel" so to speak...
Another solution that is quite easy to set up is Tailscale. https://tailscale.com/
It is also a VPN solution of sorts, and they even have a plugin for pfsense. You will need to install a client on each device that you want to use to access your home, like your phone, laptop etc. I belive with the free version you can have up to 3 clients.
Then you set up Tailscale on pfsense, or in a docker container if you prefer that, as the "access node" and via that your clients can access your entire LAN or parts of it, however you want to set it up. -
@Elmojo said in Cannot PF/NAT to save my life...:
. I just can't imagine why no one has had me do this simple check!
And where are your threads where you asked about port forwarding? This is always the first thing to validate when users having issues. 2nd on even after they say they have public is simple sniff on their wan while they run say a check from can you see me . org - do you see the traffic.. If not there is nothing pfsense can do.. It can not forward what it never sees.
I don't know you worked with before - but I find it highly unlikely that I would not have run across threads or multiple threads here asking for help with port forwarding... I have been here many many years.. And yeah first thing to validate is on a public IP, and traffic actually gets to pfsense... Its pointless even to look at what they are doing with forwarding or rules without knowing the traffic is actually getting to pfsense.
-
@johnpoz said in Cannot PF/NAT to save my life...:
where are your threads where you asked about port forwarding?
Mostly on Reddit. I had a couple threads here a while back, but I can't recall if they were about forwarding or not. I'm not wild about how this forum handles replies and stuff, although the folks here have been nothing but helpful. :)
-
@Elmojo well doing the packet capture to validate traffic even gets to pfsense to forward is right there in the docs
Where you actually in pfsense section or the homenetworking reddit where its mostly the blind leading the blind. And most them only have any experience is with your typical home wifi router, that can not even do a packet capture, etc.
-
@johnpoz I don't believe I've ever seen that particular doc page. It looks helpful.
I don't recall which subs I was on. I can't see how it matters now anyway.
Now that I know I'm stuck behind a NAT, I have at least an idea of what needs to be fixed.
I've spoken to my ISP, and they are 100% clueless. They don't even know what a public IP is. They are all in India, and are all reading from scripts. I've asked to speak with a higher level tech, and I'm told there are "none available at this time".
This company (Brightspeed) sucks so bad, but they are literally my only option in this area, other than satellite internet, which doesn't interest me.
It appears that my only option is to pay $15/month extra for a static IP. I'm considering it. -
@Elmojo satellite is almost always going to be cgnat as well anyway.
How is it you spoke to your isp and they are clueless - but you can get a static IP for 15 bucks a month? You mean through some vpn solution that does port forwarding?
Are you wanting this rustdesk to open to the public? Or for your own consumption while your out and about? Do you support multiple clients and you want to run their hbbs/hbbr server so you can support other clients? to talk to each other?
What is the end goal for wanting to install this software.. Remote control of other machines or your own machines there are like a bajillion ways to skin that cat..
-
@johnpoz said in Cannot PF/NAT to save my life...:
satellite is almost always going to be cgnat as well anyway.
Which is why I'm not interested.
I can actually get pretty great cellular home internet for $50/month through T-Mobile, but it's the same deal: cgnat, no option for static IP.@johnpoz said in Cannot PF/NAT to save my life...:
How is it you spoke to your isp and they are clueless - but you can get a static IP for 15 bucks a month?
Because they list it as an add-on option on their web site. But when I speak with their "tech support" people, they barely even know what an IP address is, let alone the difference between a public or private external IP, or what it means to be NAT'd.
@johnpoz said in Cannot PF/NAT to save my life...:
Are you wanting this rustdesk...
Rustdesk is just one of several containers that I've been trying to expose to external access without success for a couple years now. Each time, I always just hit a wall of frustration and give up. Now I know it was because it was never going to work as long as my ISP is monkeying with my IP. lol
Once I get a static IP, I suspect all the tutorials I've been attempting to follow will suddenly work as expected, and things will go much more smoothly.
I realize there are other ways around it. I'm already running ZeroTier for remote access of my server at work, and it's been great. However, I'd prefer not to have to jump through all those extra hoops, and put extra clients in the loop, for each service I want to run externally. It would be far easier if things just worked. I may be wrong, and please tell me if I'm misunderstanding how this all works, but I think a static public IP would solve all that, right? -
@Elmojo it doesn't even have to be "static" you just want a public IP that is can get unsolicited inbound traffic. Quite often when you have a public IP via dhcp, even though not "static" it rarely changes... I have had the same IP for years at a time... The last time it changed was when my isp merged with another isp and they redid their whole IP structure... But since then I have had the same IP..
Now to get around them using cgnat for you, its quite possible they will give you a static for a fee.. But it doesn't really have to be static, as long as its not changing like very hour or every 24 hours or something should be fine.. DDNS is a way to keep some public record updated with what your public IP is.
You just need for it to be able to get a public one that people can send traffic too that you see.. You sure you don't just have a isp device in front of pfsense that has the public IP?
Pfsense wan IP shows what? 10.x, 192.168.x.x or 172.16-12.x.x ? This rfc1918 space.. Normally ISP would not use this range for cgnat... They would use 100.64.0.0 thru 100.127.255.255, this is the range 10.64.0.0/10
What does your pfsense wan IP show?
If you go to status interfaces.. What does it show for pfsense wan?
Maybe your isp device in front of pfsense is just doing normal nat? And gives pfsense say a 192.168.x.x, 10.x.x.x, or 172.16-31.x.x adderess? if pfsense IP is 100.64-127.x.x then yeah that is the cgnat range.
If its just your isp device your plugging pfsense into - they can quite often be put into bridge mode, that passes the public IP to pfsense wan.. Or even if not, you can setup pfsense in what is call dmz host mode, where all unsolicited inbound traffic to your actual public IP is forwarded to pfsense wan IP.
-
@johnpoz This is helpful, thank you. I'll respond in the morning more fully when my eyes aren't crossed. lol
-
@johnpoz said in Cannot PF/NAT to save my life...:
it doesn't even have to be "static" you just want a public IP that is can get unsolicited inbound traffic. Quite often when you have a public IP via dhcp, even though not "static" it rarely changes...
Unfortunately, my ISP are idiots, and no one I've spoken with so far even knows the difference between a static and dynamic IP. The last person told me that my IP was likely to change "due to the activity of my devices". Uh huh, right.
Also, mine changes quite often. My internet just...drops...about 2-3 times per month, and I get a new IP every time it comes back up. So every couple weeks at least, I have a new IP to deal with. It's maddening, to say the least.@johnpoz said in Cannot PF/NAT to save my life...:
You sure you don't just have a isp device in front of pfsense that has the public IP?
I'm fairly sure, but honestly I wouldn't trust that this DSL modem (it's a Zyxel c3000z) isn't pulling some shenanigans without my knowledge. I jumped through all the hoops to get it into bridge mode (I know that's not the proper term, just can't recall exactly what we did right now) so that I can use my pfsense box as the true router.
@johnpoz said in Cannot PF/NAT to save my life...:
Pfsense wan IP shows what?
Looks like this:
Does that help?Sorry for the delay. Today ended up being unexpectedly crazy.
-
@Elmojo that is a public IP.. that is not rfc1918 or cgnat range..
How often it changes - is workable.. especially if its not like every hour or something..
So do a simple test.. Go "can you see me . org".. I didn't put that together but hope you can figure out what the domain is
Now pick a port any port lets call it 6666, send some traffic to the IP it shows for yours.. While you do a packet capture (under diag menu)... Do you see this traffic..
Here doing the same test..
Doesn't matter if fails, what we are looking for is actually gets to pfsense wan interface.. You prob want to verify that the IP can you see me shows is the same IP pfsense has for its wan.. If not maybe your behind a proxy?? But those IPs should be the same.. See mine starts with 209, from what your posted should start with 75 and last number should be 75.. Should be the same address.. Now on your packet capture do you see that traffic get to pfsense... See how my test failed (because I have nothing listening on that port) but you can see that pfsense saw it..
If you see the traffic then we can for sure get stuff working for you, and your good to go - and we can work out how to setup a ddns so a fqdn (fully qualified domain name) points to your public IP - even if it changes down the road, and will be updated if does in like 5 minutes.. etc.. But first thing we need to validate is traffic that is unsolicited can be seen by pfsense. That is what this test will validate.
edit: I just looked and the IP you last talked to the forums does line up with that 75.x.x.75 address - I see some other ones in a different range 174.x.x.x and another one that is close to the 75.x.x.75 address but slightly different network.. What I can not tell is how long ago those other IPs were used.. But currently your IP you talked to the forum with does line up with what you posted.. Maybe those 174 address was you talking to the forum from your phone, or elsewhere - or maybe your IP does change, but again to be honest even if changed every hour - as long as you can get to it from the public internet we can work with that.. If it changes every hour it could be problematic - but still workable.. We really just need to validate that pfsense can see unsolicited inbound traffic so we can forward it to something behind pfsense.
