Unable to do Open NAT in pfSense 2.7.2-RELEASE
-
@Sherwatt From Listening for NAT-PMP it looks normal to me.
And from your screenshots it looks like you have everything set up as it should be for gaming...
Elite : Dangerous seems to need only 5100 open on PC. So it would likely show up in the status page for UPnP if it is being requested by that game.
https://portforward.com/elite-dangerous/The time out that you see is actually UPnP sending to your PC over Windows SSDP (Simple Service Discovery Protocol). But your PC is either blocking it (check firewall) or was not online at the moment.
Perhaps try turning off the windows firewall for a moment to see if that resolves some of these issues with gaming.
-
Yes, looks like everything is set up to work, but it still doesn't. Not even a simple port opening (forwarding) seem to work.
As a test I added a port forwarding rule for my PC with port 4444 and tested with multiple external port checker sites and all reported it Closed. Then I changed it to 5100 and it still showed closed, and Elite still reported restricted.
I did a packet capture during starting up Elite with 5100 open and I could see my PC communicating with an external IP on that port. But only the request from external sites show up in packet capture when doing a port check.
I am starting to give up and just return to my old shitty ASUS router... Which is bad as I purchased new hardware for pfSense. And I will need to open more ports later for other services, but first I need to resolve this NAT issue.
Can I turn on some kind of debug log in pfSense somewhere?
Or, can I just test pfSense on another device that is not connected to the internet? The reason behind this is that I can't just test it on the real WAN connection, as other people need working internet in the house. But I have some other hardware I could install pfSense, I just don't know if/how to test NAT on that... -
@Sherwatt Hmmm, it's really strange that you don't seem to be able to open ports. However, using port checkers may not always give you the truth... Try opening port 443 towards your PC since that will show at least. But even some of those ports listed may show up as closed even if they are open.
You can test with netcap from linux or WSL on your PC.
Run the command nc -zvu yourexternalip PORT# (the -u command is for UDP and if you remove it the test will run TCP).For me without UDP it doesn't render a result but with UDP it shows this for SIP :
Connection to myexternal-IP 5060 port [udp/sip] succeeded!If I test for 25565 (Minecraft), I get "port 25565 (tcp) failed: No route to host"
Because the Minecraft server is down, so nothing responds on that port.However, when I run yougetsignal or portchecker.co, they both report these ports to be closed.
Another thing... the MAC on your ASUS router, have you cloned that onto your pfsense WAN interface? If not I think that could be a good idea, since it will make sure you can change between them without issues. Also, could you check your public IP to make sure it is in fact a public IP and not from some CG-NAT range.
Also you say Elite reports "restricted" but that doesn't necessarily mean it is a problem. You should never have Full Cone NAT on your home router, and Retricted NAT or Port Restricted NAT are both ok as long as the right ports get opened...
-
Hey @Gblenn, thank you for all your inputs so far. Now I think there might still be hope...
I opened up port 443, but both test sites reported it as closed. Then I ran the nc command in WSL and for TCP it timed out, but with UDP it succeeded, same as your situation.
EDIT: I spoke too soon. After removing this test rule and removing the States from pfSense and even rebooting my PC, the UDP port 443 still succeeds. Maybe something else is causing it to succeed and not my tinkering in the firewall. :/
I did not clone the router's MAC. Maybe I will give it a try later, I just don't know why would I need that.
I checked and the public IP is not in the CG-NAT range (not in 100.64.0.0/10).@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Also you say Elite reports "restricted" but that doesn't necessarily mean it is a problem. You should never have Full Cone NAT on your home router, and Retricted NAT or Port Restricted NAT are both ok as long as the right ports get opened...
Maybe this is true. I hope it is.
I don't know what NAT type different games thought my ASUS router had when I was using that, as no game complained and all multiplayer sessions worked. I started looking into this whole thing after switching to pfSense and then GTA Online warned me that my NAT type is strict. But it is much more difficult to test this with GTA, as that game takes ages to load. I hope I can get into a session soon with my friends and see if that message now pops up or not (I don't think you can check the NAT type anywhere in the menu, but I might be wrong).BTW, I am not sure anymore if I remember correctly, but I think when I opened up ports in the ASUS router, I could always verify they are open using any external port tester sites, as the response was always "open", even when I had not yet started the service on that port (first I wanted to confirm it is open). Is it possible that that has now changed with this pfSense + AP setup?
-
@Sherwatt said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
I did not clone the router's MAC. Maybe I will give it a try later, I just don't know why would I need that.
I checked and the public IP is not in the CG-NAT range (not in 100.64.0.0/10).My thinking about cloning here is if there is anything on the ISP side, the modem/router or their gateway that is interfering, cloning your ASUS MAC might solve it. Since you know that router worked...
Btw, what ISP and what modem is it?EDIT: I spoke too soon. After removing this test rule and removing the States from pfSense and even rebooting my PC, the UDP port 443 still succeeds. Maybe something else is causing it to succeed and not my tinkering in the firewall. :/
Hmm, I'm thinking that this is likely due to the "connectionless" nature of UDP, not expecting any handshake. So perhaps a false positive. I get the same result as you, closing that port off running the test with netcap and UDP. Testing with portchecker.co works though. So in this case (443) I suppose only TCP should be tested.
And just double check that you selected both TCP/UDP for that rule, and clicked Apply after saving? You also need to wait a short moment for rules to reload...
Another, better way of testing would be to use a VPN, to make sure you are really testing from the internet.But I just realized another setting, under System > Advanced > Firewall & NAT. What have you set at NAT Reflection mode for port forwards and Enable automatic outbound NAT for Reflection?
I have Pure NAT and the tick box activated for Automatic creation of outbound rules.Also, even though GTA takes a lot of time to load, that information about Strict, Moderate or Open NAT is really what you are looking for. The reporting from Elite will probably not help you much in this case. Unless it has that info somewhere else?
In fact you could test it by going back to Automatic Outbound rules instead, so you no longer have Static ports. To see if Elite changes from Port Restricted, and if checkmynat.com also gives a different result. It should now say Symmetric NAT, and having UPnP should still allow for Open NAT in your games...Here's how it looks for me, https://www.checkmynat.com:
And the system menu in a CoD game:
Also, did you try disabling windows defender during testing?
-
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Btw, what ISP and what modem is it?
It is now called One, previously DIGI in Hungary. This is PPPoE connection and the ISP modem is a Huawei OptiXstar with fiber connection.
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
And just double check that you selected both TCP/UDP for that rule, and clicked Apply after saving? You also need to wait a short moment for rules to reload...
Yes, I did, and before testing I released and renewed the PC's IP config.
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
But I just realized another setting, under System > Advanced > Firewall & NAT. What have you set at NAT Reflection mode for port forwards and Enable automatic outbound NAT for Reflection?
I have Pure NAT and the tick box activated for Automatic creation of outbound rules.Yeah, I already played with these without success. Most online forums I read don't mention this part and since these are disabled by default, I assume I wouldn't need to touch these. For now I left them disabled, also because of what you said next and what I did:
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Also, even though GTA takes a lot of time to load, that information about Strict, Moderate or Open NAT is really what you are looking for. The reporting from Elite will probably not help you much in this case. Unless it has that info somewhere else?
In fact you could test it by going back to Automatic Outbound rules instead, so you no longer have Static ports. To see if Elite changes from Port Restricted, and if checkmynat.com also gives a different result. It should now say Symmetric NAT, and having UPnP should still allow for Open NAT in your games...I just tested this and you are right. When I change pfSense from Hybrid to Automatic, I do get Symmetric as a result in the Check My NAT, but Elite still reports as restricted and still reports UPnP as ON. Then I did a quick google search and it turns out you can check your NAT type in GTA, just open the Home menu and clicking on the gear icon you will be able to see Network information. It said Moderate, which is great news, as it is not Strict anymore. :) And since I never checked this before pfSense, maybe I was using it with Moderate all these years and it was fine, and I really don't need Open.
I could also see an entry related to GTA appear in the Status > UPnP page, so UPnP definitely works now, I think. :)@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Also, did you try disabling windows defender during testing?
I did try that once, but didn't like it, because I never had to disable it and I am sure I will not tolerate Windows constantly reminding me to turn it on, so I after a quick test I turned it back.
Thanks for all your insights and advice on this topic @Gblenn, I appreciate your time very much. I owe you a few beers. :) I will stop testing this now and just will go ahead and start rebuilding my home lab, hopefully everything will work.
Cheers! -
@Sherwatt said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Most online forums I read don't mention this part and since these are disabled by default, I assume I wouldn't need to touch these. For now I left them disabled, also because of what you said next and what I did:
If you are hosting a separate server of some sort, like TeamSpeak, Minecraft or perhaps NextCloud. You probably want to use your public IP to access it, for simplicity and consistency. Applying those settings will let pfsense accept the external IP and translate it back to the correct LAN IP based on your port forwards that you have for the server.
So not needed in this scenario...It said Moderate, which is great news, as it is not Strict anymore. :) And since I never checked this before pfSense, maybe I was using it with Moderate all these years and it was fine, and I really don't need Open.
I could also see an entry related to GTA appear in the Status > UPnP page, so UPnP definitely works now, I think. :)Well that is really good, since Moderate will give you more flexibility that Strict ever does. But I would actually have expected Open NAT since you are running UPnP. And all your settings seem correct...
Also as I think I mentioned earlier, setting Outbound NAT to Hybrid mode and Static Ports for your gaming PC's, will likely speed up the startup of some games. At least I have noticed a slight improvement with CoD for example.
-
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
If you are hosting a separate server of some sort, like TeamSpeak, Minecraft or perhaps NextCloud. You probably want to use your public IP to access it, for simplicity and consistency. Applying those settings will let pfsense accept the external IP and translate it back to the correct LAN IP based on your port forwards that you have for the server.
I did run a few services that relied on port forwarding with the previous setup and I want to rebuild them, so fingers crossed that I already have all the knowledge I need to make them work.
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
But I would actually have expected Open NAT since you are running UPnP. And all your settings seem correct...
Oh, no, don't say that and send me back to troubleshooting hell! Moderate is probably enough... :) I hope.
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Also as I think I mentioned earlier, setting Outbound NAT to Hybrid mode and Static Ports for your gaming PC's, will likely speed up the startup of some games. At least I have noticed a slight improvement with CoD for example.
Yes, and it is set to Hybrid now and I do have the two gaming PCs mapped in this outbound NAT mode with static IPs. I didn't really had time to play games in the past few days partly due to this issue, but soon I will see how they behave.
-
@Sherwatt said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
did run a few services that relied on port forwarding with the previous setup and I want to rebuild them
In that case, you will likely want to turn those things on in the Advanced > Firewall & NAT settings anyway.
Oh, no, don't say that and send me back to troubleshooting hell! Moderate is probably enough... :) I hope.
Haha, no I think you will be fine. The only situation I know when Moderate is not good enough, is if your friends have Strict NAT and you want to play together. Strict will only be able to connect to those with Open NAT.
Yes, and it is set to Hybrid now and I do have the two gaming PCs mapped in this outbound NAT mode with static IPs. I didn't really had time to play games in the past few days partly due to this issue, but soon I will see how they behave.
Aha, so two PC's playing the same game? In that case, it might be so that you can only get Open NAT on one and Moderate on the other. I have a vague memory of that being discussed in some of the older threads about UPnP...
-
@Gblenn said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
Aha, so two PC's playing the same game?
No, we play different games, so this shouldn't be a problem. :)
-
@Sherwatt said in Unable to do Open NAT in pfSense 2.7.2-RELEASE:
No, we play different games, so this shouldn't be a problem. :)
Unless they require the same port... Which for example many Activision games do, like port deamonware port 3074. But then again, they usually have the ability to select alternative ports as well. So with UPnP they should be able to retry another if the first one is already in use.