pfsense ce 2.7.2 configured with port forwarding, packet drops randomly (pfsenseplus looks like work)

[allenlwli]

I configured port forwarding rules for our application, to allow the client access this application, we need allow 3 tcp and 4 udp ports

then we lauched the connections, but most time it will be failed to connect only few of chance we can connect through.
I capture network logs on pfsense and client at the same time, from logs on client side i found many retransmit and cause the connection stopped, while i checked logs on pfsense, i found syn/syc+ack, but looks like tcp packet didn't hit on wan interface

i did lots of tuning, such as re-install pfsense ce, enlarge the spec(cpu/mem), tuning parameters, but the same not work

we did the same on pfsense plus (23.09), looks like it works on pfsense plus.

so my question is:
1、is it possible known issue/bug for this case?
2、how should i trouble shoot further for this kind of issue; in another word, how could i check confirm where and how the packet drop?

Thanks much for your help!

[Gertjan]

@allenlwli said in pfsense ce 2.7.2 configured with port forwarding, packet drops randomly (pfsenseplus looks like work):

but looks like tcp packet didn't hit on wan interface

If packets don't hit = arrive (right ?) at the pfSense WAN gate, your pfSense issues is solved, as the issue is upstream.

Not sure what this is :

but for classic port and addresses NATing I never hat to take that setting from 'default'.

[allenlwli]

@Gertjan
thank you much for your help
For NAT reflection, even we tried to use options like system default/disbaled/pure NAT, the same not working

The thing is if I switch to use pfsense plus (23.09), which is under same subnet as pfsense CE, then the connectivity will be good;
I am a little bit suspect there is ongoing bug with pfsense CE

[allenlwli]

This post is deleted!

[allenlwli]

i finally found the cause, i changed the 'Filter Rule association' from 'pass' to other, i then works

but the thing is we have default gateway and even i allow all in firewall rule, but nat with filter rule association 'pass', nat still not forward the traffic; looks like it's the bug of pfsense