Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Allowing random IP/PORT into LAN

    Scheduled Pinned Locked Moved NAT
    54 Posts 5 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Bob.DigB
      Bob.Dig LAYER 8 @wwdot_computers
      last edited by

      @wwdot_computers said in Allowing random IP/PORT into LAN:

      I do not want things calling

      Good luck with this approach.

      johnpozJ 1 Reply Last reply Reply Quote 2
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Bob.Dig
        last edited by johnpoz

        @Bob-Dig yeah not really fan of that sort of blocking to be honest either.. If something bad was going to be calling home - they would be doing it over known used ports anyway - most likely 443 these days now that anyone can get a ssl cert for any domain they have control over in like 30 seconds ;)

        If you run bad code and it wants to talk outbound your too late if you ask me.. Hey I log outbound traffic from my iot stuff for example - and I do take a look at now and then to see if anything fishy is going on..

        Blocking via dns is much easier to stop from going to place you don't want users going to to be honest. Or blocking known bad IP ranges, sure ok.. But then again most bad stuff prob just going to spin up an instance in some CDN or hosting platform anyway. But trying to run a allow only specific your going to be doing that a lot ;) Its a lot of work..

        What I find odd is called support, why wouldn't they just have given you the IP (range or ASN) and port(s) when you called them and said you were having issues?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • W
          wwdot_computers
          last edited by

          Thank you all for responding. I do use a DNS filter for my clients. I kind of figured that there was not going to be a way to dynamically open ports. I was on the phone with support for a while last night. While the guy had some good knowledge of firewalls and networking, I had already tried all of his suggestions. All I wanted to know was the port and IP ranges. He pinged his colleague and had zero luck finding out that information.

          I will continue to use my VPN for the video calls.

          However, that does not fix my issue regarding the Datto Backup. I have added the ports that need to be open into an alias, as I sure you can see, both the TCP and UDP. There is one port that they are saying needs inbound access:

          Inbound connectivity on the protected machine:
          TCP port 25568 (for Datto Windows Agent service)

          How do I open that up? Like I said, new to pfSense and the like. I have tried creating a WAN rule, I must not have had things correct because the agent still would not connect. I tried NAT, and must have the same issue as the agent just would not connect. However, like the video call, the agent connects fine when on VPN.

          S johnpozJ 2 Replies Last reply Reply Quote 0
          • S
            SteveITS Galactic Empire @wwdot_computers
            last edited by

            @wwdot_computers Datto would be on your network so is not related to pfSense, because traffic between PCs on the same interface doesn't go through the gateway. They mean, open that port in the Windows firewall.

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote ๐Ÿ‘ helpful posts!

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @wwdot_computers
              last edited by johnpoz

              @wwdot_computers if you want port 25568 that hits you public facing interface (wan) to get forward to some inside machine say 192.168.1.100 that would just be a port forward.

              That and then the associated firewall rule that the port forward can auto create for you.. Just need to make sure the rule is in the correct place on your wan so some other rule you might have placed there doesn't block the traffic your trying to allow.

              edit: if this is machine A talking to B that are on the same network - as @SteveITS mentions pfsense has nothing to do with that traffic.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • W
                wwdot_computers
                last edited by

                @SteveITS @johnpoz

                So the agent is on multiple machines on the LAN. They talk back to Datto servers for backup. We do not have an in-house appliance that we are backing up to, it is strictly a cloud backup. I guess I am asking how do I open up the port for the entire network or a pool of computers?

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @wwdot_computers
                  last edited by johnpoz

                  @wwdot_computers but that is outbound traffic - you would have to adjust your rules to allow for the traffic.. So you see that blocked.. By default default deny is logged.. So if your rules do not allow these to talk to something in the cloud, ie the internet then one of your rules is not allowing it.

                  Did you inherit this set of rules? I would assume someone that created all those would understand how to allow something else..

                  You say this is inbound

                  Inbound connectivity on the protected machine:
                  TCP port 25568 (for Datto Windows Agent service)

                  I find it highly unlikely that some service you backup to in the cloud would need unsolicited inbound traffic from the internet to some machine behind pfsense.. But that would be a port forward.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • W
                    wwdot_computers
                    last edited by

                    @SteveITS
                    It was a joint effort? Under guidence I created the rules. However the person that helped is no longer able to do so. Long story.

                    Would you suggest going back through the rules and starting over?

                    So the inbound connection:

                    Inbound connectivity on the protected machine:
                    TCP port 25568 (for Datto Windows Agent service)

                    Is really outbound? How does that track? It seems that they are requesting an inbound connection?

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @wwdot_computers
                      last edited by johnpoz

                      @wwdot_computers see my edit.. I have never heard of some backup service to the cloud that would require you to open a port from the internet to your server your backing up - that makes no sense at all.

                      Unless you have turned off default deny logging that is logged, and your last reject rule is set to log - so if pfsense blocked something from it would be logged

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • W
                        wwdot_computers
                        last edited by

                        @SteveITS

                        Sorry wrong person

                        @johnpoz
                        It was a joint effort? Under guidance I created the rules. However, the person that helped is no longer able to do so. Long story.

                        Would you suggest going back through the rules and starting over?

                        So the inbound connection:

                        Inbound connectivity on the protected machine:
                        TCP port 25568 (for Datto Windows Agent service)

                        Is really outbound? How does that track? It seems that they are requesting an inbound connection?

                        How do I see the edit? New to the forum as well.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wwdot_computers
                          last edited by

                          @johnpoz

                          Here is the KB:
                          https://continuity.datto.com/help/Content/kb/siris-alto-nas/KB213994246.html

                          S johnpozJ 2 Replies Last reply Reply Quote 0
                          • S
                            SteveITS Galactic Empire @wwdot_computers
                            last edited by

                            @wwdot_computers said in Allowing random IP/PORT into LAN:

                            https://continuity.datto.com/help/Content/kb/siris-alto-nas/KB213994246.html

                            Datto runs on a backup device in the office and backs up PCs in the office. "on the protected machine" is each PC in the office.

                            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                            Upvote ๐Ÿ‘ helpful posts!

                            1 Reply Last reply Reply Quote 0
                            • W
                              wwdot_computers
                              last edited by

                              @SteveITS

                              No, I get what it is saying. We do not have the appliance though and each system has an agent installed on it. The agent talks back to the Datto cloud for backup.

                              I hope that I am making sense.

                              S 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @wwdot_computers
                                last edited by

                                @wwdot_computers that screams the local firewall on the device your running that agent, not from the internet.. Since that makes zero sense at all that you would have to make

                                Here is a drawing on their site..

                                drawing.jpg

                                See the local network cloud.. This siris box talking to your protected box... So unless this box is on some other vlan in your local network than the protected machine.. There is no firewall rules needed in pfsense.. But the protected machines local host firewall would have to all that traffic.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • S
                                  SteveITS Galactic Empire @wwdot_computers
                                  last edited by

                                  @wwdot_computers said in Allowing random IP/PORT into LAN:

                                  We do not have the appliance though and each system has an agent installed on it. The agent talks back to the Datto cloud for backup.

                                  You linked the Datto BCDR backup which AFAIK is only via an on site device, either Alto or Sirus.

                                  Do you have Endpoint Backup?
                                  https://continuity.datto.com/help/Content/kb/EB/EB-GettingStarted.htm
                                  (or others going down the left menu on that page)

                                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                  Upvote ๐Ÿ‘ helpful posts!

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wwdot_computers
                                    last edited by

                                    @johnpoz

                                    That is an inaccurate representation of our setup as we do not have a Siris box or any other for that mater. Each machine needs to connect to the internet directly for the backup. All of the machines are not able to connect, so I do not think it is a local machine firewall issue.

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      wwdot_computers
                                      last edited by

                                      @SteveITS

                                      That is correct. We have the Datto Endpoint Backup
                                      Endpoint Backup is our fully cloud-based backup and recovery solution for Windows Servers or PCs. You can leverage its features to restore single files or the entire backup image to a new device without any extra equipment required. Select a topic from the left navigation pane to continue.

                                      I am not sure why the tech support linked me that other link. Sorry, was just not looking. However, that being the case, still have the issue :(

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @wwdot_computers
                                        last edited by johnpoz

                                        @wwdot_computers said in Allowing random IP/PORT into LAN:

                                        We have the Datto Endpoint Backup

                                        ok so here

                                        https://continuity.datto.com/help/Content/kb/DEBPC/360001005506.html
                                        Getting Started with Datto Endpoint Backup for PCs

                                        Where does it say anything about inbound?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        W 1 Reply Last reply Reply Quote 0
                                        • W
                                          wwdot_computers @johnpoz
                                          last edited by

                                          @johnpoz said in Allowing random IP/PORT into LAN:

                                          @wwdot_computers said in Allowing random IP/PORT into LAN:

                                          We have the Datto Endpoint Backup

                                          ok so here

                                          https://continuity.datto.com/help/Content/kb/DEBPC/360001005506.html
                                          Getting Started with Datto Endpoint Backup for PCs

                                          Where does it say anything about inbound?
                                          /
                                          Looking at that KB, which I should have caught the first time around, there is not an inbound. I have opened the appropriate ports of outbound, but in the logs, it seems to block 587/443 and such.

                                          Ideas?

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @wwdot_computers
                                            last edited by johnpoz

                                            @wwdot_computers yeah open the ports they list outbound - no where in that list does it say anything about the port you were listing.

                                            ports.jpg

                                            There is also that 3262 port, but that seems to only be needed for bare metal restore.

                                            edit: most of these rules make zero sense if you have endpoint only

                                            theserules.jpg

                                            Those ports are not listed in their doc, what do you have in the alias?

                                            edit2: As a troubleshooting tool, create a rule on the top that allows one of your machines your trying to backup any any.. Log its traffic - what ports does it talk on for talking to backup?

                                            Maybe your issue is dns related? And it can't resolve what that list says it needs to be able to resolve.. But looks like it need only 443 outbound, and then one of those 3 ports.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.