I can not block WAN port?

johnpoz

@mucip said in I can not block WAN port?:

By the way I have NAT

No you don't there is no way your port forward in pfsense would work without a firewall rule to allow it.f And you have no rules in floating and no rules on your wan that would allow it..

So you could have whatever you want in port forwards, and they wouldn't work.

I would suggest you look at your full ruleset, maybe your gui is not showing you the rules or something - but from what you posted you could have 100 different port forwards and none of them would work, because you have no firewall rules on the wan to allow them.

https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

mucip

@johnpoz ,
Maybe I misexplained sory.
I have NAT rules and also releated Firewall rules. No problem. Cameras are working. 80/443 are working and other NAT ports are working correctly.
Maybe there is 1024 port opne in rules but GUI don't show it I don't know?

Can I see the firewall rules in console viewer to check?

Regards,
Mucip:)

johnpoz

@mucip said in I can not block WAN port?:

Maybe I misexplained sory.

The wan rules you posted would not allow anything.. Did you not post up your firewall rules?

These rules show nothing would be allowed

And again - with what you posted there is zero reason to put in any blocks because every interface has a default deny.. And that rule you put in for 1024 would never trigger anyway because you have the source port set to 1024, not the destination port.. The traffic you show as open is TO 1024, not from a source port of 1024

If you want people to help you - post up your full port forwarders and your full wan rule set.. But what you posted, no port forwards would be allowed.

mucip

@johnpoz ,
Sure I have many more rules after than last 1024 line above picture. I don't want to send them all rows because of security reasons.

Yes I changed it to destination port. But still looking open unfortunatelly?!

Regards,
Mucip:)

Bob.Dig

@mucip NAT rules can be set to "pass", so that is a possibility. But if you don't know the difference between source and destination port, you have bigger problems to begin with.

mucip

@Bob-Dig,
No. There isn't any line ported 1024 in NAT page either.

Regards,
Mucip:)

johnpoz

@mucip because its not pfsense - do you have a port forward sending 1024 somewhere? If not then pfsense should not be listening on that port that is for sure.. But you can easy check with a netstat.. And again the rules you posted wouldn't allow anything.. can not help you figure out what you have that is allowing answer from some port if can not see your rules.

1024 can be used for modem admin, etc. it is quite possible your isp device in front of pfsense is answering on that..

Here is what I would do, do a simple sniff on pfsense wan - go to can you see me . org send some traffic to tcp 1024.. Do you see an answer.. If you do then pfsense or something behind it answered.. If you do not even see the 1024 hit you, then something upstream answered, or even if you do see it hit pfsense wan - if you don't see an answer then its not showing up because pfsense answered - but something in front of your pfsense did.

Here is example of sending traffic to my wan on 1024.

So clearly my pfsense or nothing behind it answered - so it shows closed. Do the same test - do you see it hitting your pfsense, do you see pfsense answer it?

edit: here is an example of seeing either pfsense or something you port forwarded to answering... See how I see a response sent back with my packet capture on pfsense wan

Because I port forward that port to something behind pfsense.

mucip

@johnpoz said in I can not block WAN port?:

1024 can be used for modem admin, etc. it is quite possible your isp device in front of pfsense is answering on that..

This might be the answer.
There is modem in front of the PfSense. I need to check it too...

Regards,
Mucip:)

johnpoz

@mucip so - for your own sanity, do the packet capture on pfsense wan when you do that test, do you see that 1024 hit pfsense wan, do you see a response.

If you don't then clearly you have a smoking gun that something in front of pfsense answered it.

mucip

@johnpoz said in I can not block WAN port?:

so - for your own sanity, do the packet capture on pfsense wan when you do that test, do you see that 1024 hit pfsense wan, do you see a response.

You're right. :)
I did not try Packet Capure until now. I will googling and inform you.

But it'looks modem answerign it?

Regards,
Mucip:)