Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    unable to get firewall to route traffic

    Scheduled Pinned Locked Moved NAT
    52 Posts 5 Posters 4.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Z
      zari90 @Bob.Dig
      last edited by

      @Bob-Dig
      tested but the port is not open and I don't think my ISP blocks anything I have a dlink router that i replaced with this netgate and everything works fine just not very secure
      bfe6e0e3-0278-496a-94d8-64829edc7bf9-image.png 99b2fa77-8023-4adf-88c4-7cff922faf07-image.png

      M Bob.DigB 2 Replies Last reply Reply Quote 0
      • M
        MoonKnight @zari90
        last edited by MoonKnight

        @zari90

        LAN address should be your server IP(pi-node IP)

        0a09eedf-5e1d-4b16-b06b-c4821c2e0e4d-image.png

        --- 24.11 ---
        Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
        Kingston DDR4 2666MHz 16GB ECC
        2 x HyperX Fury SSD 120GB (ZFS-mirror)
        2 x Intel i210 (ports)
        4 x Intel i350 (ports)

        1 Reply Last reply Reply Quote 0
        • Bob.DigB
          Bob.Dig LAYER 8 @zari90
          last edited by Bob.Dig

          @zari90 Whatever a pi-node is, it is not running on your pfSense LAN-address. If it is running on your Windows-machine, use the IP-address of that machine instead.

          Z 1 Reply Last reply Reply Quote 0
          • Z
            zari90 @Bob.Dig
            last edited by

            @Bob-Dig

            its on dhcp though so the windows 10 machine will pick up a new IP when it restarts i've changed it now to a static IPbb6b250e-48f5-4f82-beda-63c4faf7fc41-image.png cded8f02-70cf-4b81-a580-67ffa273ec3d-image.png not working either

            Bob.DigB 1 Reply Last reply Reply Quote 0
            • Bob.DigB
              Bob.Dig LAYER 8 @zari90
              last edited by

              @zari90 said in unable to get firewall to route traffic:

              not working either

              Show the WAN rules now, we want to look at the "states".

              Z 1 Reply Last reply Reply Quote 0
              • Z
                zari90 @Bob.Dig
                last edited by

                @Bob-Dig
                8ce5bb1b-e3c3-4a9c-9ddf-c052a21452d3-image.png removed rules earlier to start fresh

                Bob.DigB M GertjanG 3 Replies Last reply Reply Quote 0
                • Bob.DigB
                  Bob.Dig LAYER 8 @zari90
                  last edited by Bob.Dig

                  @zari90 If you create a NAT-Rule, there should be placed a rule on WAN for you. So something is not right. Remove the NAT rule and create it again, then look if the WAN rule was created. If not, you are doing something wrong.

                  Z 1 Reply Last reply Reply Quote 0
                  • M
                    MoonKnight @zari90
                    last edited by

                    @zari90
                    In your NAT rule, make sure you have it like this.

                    7e6405fe-9e8f-4f55-a866-ecfdd70d735e-image.png

                    --- 24.11 ---
                    Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                    Kingston DDR4 2666MHz 16GB ECC
                    2 x HyperX Fury SSD 120GB (ZFS-mirror)
                    2 x Intel i210 (ports)
                    4 x Intel i350 (ports)

                    1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @zari90
                      last edited by Gertjan

                      @zari90

                      No rules means :
                      nothing can enter WAN.

                      If you have created a NAT rule (from WAN to LAN), then there will be auto created a WAN firewall rule, so the traffic can actually enter the WAN. It has to enter, so the NAT rule can do its job=>sending the traffic to the pfSense LAN network with the good LAN IP.

                      Check your NAT rule, at the bottom you'll find :

                      38209c20-fafc-4887-951a-edb779cb7a25-image.png

                      and clicking on the blue "View the filter rule" (which is a pass rule in WAN normally) will show you the firewall rule. The one you've just deleted ....

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • Z
                        zari90 @Bob.Dig
                        last edited by

                        @Bob-Dig

                        c5cc4e23-79fc-4861-ab88-53f2ca623335-image.png
                        done rule is there now but still not open
                        3aa8c390-4e3d-4546-a041-595fac255c6a-image.png

                        Bob.DigB Z 2 Replies Last reply Reply Quote 0
                        • Bob.DigB
                          Bob.Dig LAYER 8 @zari90
                          last edited by Bob.Dig

                          @zari90 said in unable to get firewall to route traffic:

                          done rule is there now

                          The states show zero, that is not good. This could mean something is blocking it before pfSense. Or you using the wrong address with the port-checker? Have you tried with your WAN-IP-Address or just with a domain name? Try both. If it is still not working and that port tester is working, there is something else blocking it before pfSense. And there is nothing we could do about that within pfSense and here.

                          Z 1 Reply Last reply Reply Quote 0
                          • Z
                            zari90 @zari90
                            last edited by

                            @zari90
                            just with the wan IP the windows 10 machine is not in dns, let me try with Jellyfin add a rule and see if that works

                            Bob.DigB 1 Reply Last reply Reply Quote 0
                            • Z
                              zari90 @Bob.Dig
                              last edited by

                              @Bob-Dig

                              963d6703-1b5a-435b-943e-369179cde1c1-image.png

                              e27360ac-da1c-4735-8485-1da8867cd5f3-image.png

                              98247c3d-ad22-4e7f-92c6-7142820035c2-image.png
                              55f14345-109c-41de-bb3c-892755b76577-image.png

                              nothing changed

                              1 Reply Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8 @zari90
                                last edited by Bob.Dig

                                @zari90 said in unable to get firewall to route traffic:

                                10 machine is not in dns

                                It is not about DNS at this point. If you test the port of your WAN-IP from the outside, it should create a state on WAN if there is a rule for that. For whatever reason now there is something shown for your first rule. Don't take the screenshot to quick after the port test, wait some seconds and reload the page before you take a screenshot or look.

                                Z 1 Reply Last reply Reply Quote 0
                                • Z
                                  zari90 @Bob.Dig
                                  last edited by

                                  @Bob-Dig
                                  okay tried both domain name and WAN-IP but port still seems to closed

                                  Bob.DigB M 2 Replies Last reply Reply Quote 0
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @zari90
                                    last edited by

                                    @zari90 Look at the states.

                                    Z 1 Reply Last reply Reply Quote 0
                                    • M
                                      MoonKnight @zari90
                                      last edited by

                                      @zari90
                                      What protocol are your service running at? TCP or UDP?
                                      Not all port-tester can to UDP port test.

                                      --- 24.11 ---
                                      Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                                      Kingston DDR4 2666MHz 16GB ECC
                                      2 x HyperX Fury SSD 120GB (ZFS-mirror)
                                      2 x Intel i210 (ports)
                                      4 x Intel i350 (ports)

                                      Z 1 Reply Last reply Reply Quote 0
                                      • Z
                                        zari90 @Bob.Dig
                                        last edited by

                                        @Bob-Dig
                                        can see the state yes trickling in but port checker still shows port is closed on both NAT port forward rules

                                        Bob.DigB 1 Reply Last reply Reply Quote 0
                                        • Z
                                          zari90 @MoonKnight
                                          last edited by

                                          @MoonKnight
                                          for jellyfin its tcp/udp and the other is just tcp

                                          1 Reply Last reply Reply Quote 0
                                          • Bob.DigB
                                            Bob.Dig LAYER 8 @zari90
                                            last edited by Bob.Dig

                                            @zari90 So that is a good sign, your pfSense-WAN was receiving the connections! Now the problem is on your hosts, maybe the windows firewall is blocking something or whatever but it is not within pfSense, from what you have told us.

                                            Z 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.