Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    unable to get firewall to route traffic

    Scheduled Pinned Locked Moved NAT
    52 Posts 5 Posters 4.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Bob.DigB
      Bob.Dig LAYER 8 @zari90
      last edited by

      @zari90 said in unable to get firewall to route traffic:

      so port 31400, 31401

      Then create the NAT rule and show and explain it. Also we assume that your ISP allow unsolicited incoming connections, many don't these days. If you have a new ISP, you could be out of luck.

      Z 1 Reply Last reply Reply Quote 0
      • Z
        zari90 @Bob.Dig
        last edited by

        @Bob-Dig
        tested but the port is not open and I don't think my ISP blocks anything I have a dlink router that i replaced with this netgate and everything works fine just not very secure
        bfe6e0e3-0278-496a-94d8-64829edc7bf9-image.png 99b2fa77-8023-4adf-88c4-7cff922faf07-image.png

        M Bob.DigB 2 Replies Last reply Reply Quote 0
        • M
          MoonKnight @zari90
          last edited by MoonKnight

          @zari90

          LAN address should be your server IP(pi-node IP)

          0a09eedf-5e1d-4b16-b06b-c4821c2e0e4d-image.png

          --- 24.11 ---
          Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
          Kingston DDR4 2666MHz 16GB ECC
          2 x HyperX Fury SSD 120GB (ZFS-mirror)
          2 x Intel i210 (ports)
          4 x Intel i350 (ports)

          1 Reply Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @zari90
            last edited by Bob.Dig

            @zari90 Whatever a pi-node is, it is not running on your pfSense LAN-address. If it is running on your Windows-machine, use the IP-address of that machine instead.

            Z 1 Reply Last reply Reply Quote 0
            • Z
              zari90 @Bob.Dig
              last edited by

              @Bob-Dig

              its on dhcp though so the windows 10 machine will pick up a new IP when it restarts i've changed it now to a static IPbb6b250e-48f5-4f82-beda-63c4faf7fc41-image.png cded8f02-70cf-4b81-a580-67ffa273ec3d-image.png not working either

              Bob.DigB 1 Reply Last reply Reply Quote 0
              • Bob.DigB
                Bob.Dig LAYER 8 @zari90
                last edited by

                @zari90 said in unable to get firewall to route traffic:

                not working either

                Show the WAN rules now, we want to look at the "states".

                Z 1 Reply Last reply Reply Quote 0
                • Z
                  zari90 @Bob.Dig
                  last edited by

                  @Bob-Dig
                  8ce5bb1b-e3c3-4a9c-9ddf-c052a21452d3-image.png removed rules earlier to start fresh

                  Bob.DigB M GertjanG 3 Replies Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @zari90
                    last edited by Bob.Dig

                    @zari90 If you create a NAT-Rule, there should be placed a rule on WAN for you. So something is not right. Remove the NAT rule and create it again, then look if the WAN rule was created. If not, you are doing something wrong.

                    Z 1 Reply Last reply Reply Quote 0
                    • M
                      MoonKnight @zari90
                      last edited by

                      @zari90
                      In your NAT rule, make sure you have it like this.

                      7e6405fe-9e8f-4f55-a866-ecfdd70d735e-image.png

                      --- 24.11 ---
                      Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                      Kingston DDR4 2666MHz 16GB ECC
                      2 x HyperX Fury SSD 120GB (ZFS-mirror)
                      2 x Intel i210 (ports)
                      4 x Intel i350 (ports)

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @zari90
                        last edited by Gertjan

                        @zari90

                        No rules means :
                        nothing can enter WAN.

                        If you have created a NAT rule (from WAN to LAN), then there will be auto created a WAN firewall rule, so the traffic can actually enter the WAN. It has to enter, so the NAT rule can do its job=>sending the traffic to the pfSense LAN network with the good LAN IP.

                        Check your NAT rule, at the bottom you'll find :

                        38209c20-fafc-4887-951a-edb779cb7a25-image.png

                        and clicking on the blue "View the filter rule" (which is a pass rule in WAN normally) will show you the firewall rule. The one you've just deleted ....

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • Z
                          zari90 @Bob.Dig
                          last edited by

                          @Bob-Dig

                          c5cc4e23-79fc-4861-ab88-53f2ca623335-image.png
                          done rule is there now but still not open
                          3aa8c390-4e3d-4546-a041-595fac255c6a-image.png

                          Bob.DigB Z 2 Replies Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8 @zari90
                            last edited by Bob.Dig

                            @zari90 said in unable to get firewall to route traffic:

                            done rule is there now

                            The states show zero, that is not good. This could mean something is blocking it before pfSense. Or you using the wrong address with the port-checker? Have you tried with your WAN-IP-Address or just with a domain name? Try both. If it is still not working and that port tester is working, there is something else blocking it before pfSense. And there is nothing we could do about that within pfSense and here.

                            Z 1 Reply Last reply Reply Quote 0
                            • Z
                              zari90 @zari90
                              last edited by

                              @zari90
                              just with the wan IP the windows 10 machine is not in dns, let me try with Jellyfin add a rule and see if that works

                              Bob.DigB 1 Reply Last reply Reply Quote 0
                              • Z
                                zari90 @Bob.Dig
                                last edited by

                                @Bob-Dig

                                963d6703-1b5a-435b-943e-369179cde1c1-image.png

                                e27360ac-da1c-4735-8485-1da8867cd5f3-image.png

                                98247c3d-ad22-4e7f-92c6-7142820035c2-image.png
                                55f14345-109c-41de-bb3c-892755b76577-image.png

                                nothing changed

                                1 Reply Last reply Reply Quote 0
                                • Bob.DigB
                                  Bob.Dig LAYER 8 @zari90
                                  last edited by Bob.Dig

                                  @zari90 said in unable to get firewall to route traffic:

                                  10 machine is not in dns

                                  It is not about DNS at this point. If you test the port of your WAN-IP from the outside, it should create a state on WAN if there is a rule for that. For whatever reason now there is something shown for your first rule. Don't take the screenshot to quick after the port test, wait some seconds and reload the page before you take a screenshot or look.

                                  Z 1 Reply Last reply Reply Quote 0
                                  • Z
                                    zari90 @Bob.Dig
                                    last edited by

                                    @Bob-Dig
                                    okay tried both domain name and WAN-IP but port still seems to closed

                                    Bob.DigB M 2 Replies Last reply Reply Quote 0
                                    • Bob.DigB
                                      Bob.Dig LAYER 8 @zari90
                                      last edited by

                                      @zari90 Look at the states.

                                      Z 1 Reply Last reply Reply Quote 0
                                      • M
                                        MoonKnight @zari90
                                        last edited by

                                        @zari90
                                        What protocol are your service running at? TCP or UDP?
                                        Not all port-tester can to UDP port test.

                                        --- 24.11 ---
                                        Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                                        Kingston DDR4 2666MHz 16GB ECC
                                        2 x HyperX Fury SSD 120GB (ZFS-mirror)
                                        2 x Intel i210 (ports)
                                        4 x Intel i350 (ports)

                                        Z 1 Reply Last reply Reply Quote 0
                                        • Z
                                          zari90 @Bob.Dig
                                          last edited by

                                          @Bob-Dig
                                          can see the state yes trickling in but port checker still shows port is closed on both NAT port forward rules

                                          Bob.DigB 1 Reply Last reply Reply Quote 0
                                          • Z
                                            zari90 @MoonKnight
                                            last edited by

                                            @MoonKnight
                                            for jellyfin its tcp/udp and the other is just tcp

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.