Hamachi
-
Uhhh, NAT rules are like filter rules, first match. I'm betting you have the default NAT from LAN to WAN rule first. Please re-order them.
–Bill
-
Yes you where right about the order of the rules, this is now fixed but still no luck :'(
I reseted my states and tested a couple of times but no luck.
The only thing i have done is magic option in hamachi (12975) and the advanced outbound nat.
This is correct?My states:
self tcp 64.34.106.33:12975 <- 192.168.0.2:1328 ESTABLISHED:ESTABLISHED
self tcp 192.168.0.2:1328 -> 81.XX.134.139:57915 -> 64.34.106.33:12975 ESTABLISHED:ESTABLISHED
self udp 64.34.106.33:43961 <- 192.168.0.2:12975 NO_TRAFFIC:SINGLE
self udp 64.34.106.33:11711 <- 192.168.0.2:12975 NO_TRAFFIC:SINGLE
self udp 64.34.106.74:3713 <- 192.168.0.2:12975 NO_TRAFFIC:SINGLE
self udp 82.165.226.212:3892 <- 192.168.0.2:12975 NO_TRAFFIC:SINGLE
self udp 192.168.0.2:12975 -> 81.XX.134.139:57234 -> 64.34.106.33:43961 SINGLE:NO_TRAFFIC
self udp 192.168.0.2:12975 -> 81.XX.134.139:59478 -> 64.34.106.33:11711 SINGLE:NO_TRAFFIC
self udp 192.168.0.2:12975 -> 81.XX.134.139:61194 -> 64.34.106.74:3713 SINGLE:NO_TRAFFIC
self udp 192.168.0.2:12975 -> 81.XX.134.139:51526 -> 82.165.226.212:3892 SINGLE:NO_TRAFFIC -
I too only have the Advanced Outbound NAT set up and the Magic Option in Hamachi set. I have the Hamachi outbound rule above the the default rule and still have the same results.
self tcp 192.168.10.50:1400 -> 66.93.XXX.XXX:59271 -> 64.34.106.33:12975 ESTABLISHED:ESTABLISHED
self tcp 64.34.106.33:12975 <- 192.168.10.50:1400 ESTABLISHED:ESTABLISHED -
Isn't hamachi using UDP? Perhaps my screenshot was wrong in this regard. Please remove nat+firewall rules and start over but use UDP.
Scott
-
I don't see that Outbound Nat let's you choose between UDP and TCP.
-
Well then verify the outbound rule is the first in the list before all other rules.
-
Well then verify the outbound rule is the first in the list before all other rules.
Thats what i have done (hamachi NAT rule is at top).
But it isent working.
No Firewall rules needed?? or anything else?Happy new year to all!
-
Okay, time to install this beast.
Can you tell me how we can get a tunnel connected for testing?
-
I created one for testing.
Network name: pfsense
Password: pfsense -
It should turn green if the connection is good. Yellow if there is a problem.
-
Edit the outgoing rule and remove the source port.
Then make sure the magic option is enabled in Hamachi.
-
Well as a follow up, I tried to set it up at my work and home (both running pfSense).
No matter what I tried, I could not get it working.
Sorry!
-
I have been trying everything suggested, without any luck.
-
I have been trying everything suggested, without any luck.
I tired manually entering every combo of rule found in the Hamachi forum and nothing seems to work.
Not really sure whats going on, the Hamachi developers are going to have to give us better examples of how to make this work and they will also need to clarify why they feel that PF "over locks nat" down.
-
I'll poke at this over the weekend and see if I can figure out what's wrong with the NAT. We aren't using static-port as they suggest, but we should have been forcing the source port to be what was specified.
–Bill
-
I got it working with a 1:1.
-
Remove all prior outbound nat rules and nat port forwards pertaining to Hamachi previously setup
-
Add a Firewall -> NAT -> 1:1 to your computer
-
enable magic option in Hamachi
-
add a firewall rule to the magic port with your internal ip. the default is 12975
-
-
Erg, I hate to reply w/in an hour of the last reply, but I think I see the problem. We are going to need static-port, the implementation of that will need to be somewhat carefully thought out as it's very easy to hose stuff up (windows doesn't use terribly random source ports, conflicts are guaranteed). 1:1 nat (for those with more than one IP) might be an option - or for those with only one machine behind pfsense.
–Bill
-
I must thank you all for testing this, i know that you all have limited time for supporting something that isent pfsense specific.
This is much appreciated! -
Well I got it working using 1:1. I have multiple static IPs from my ISP. I set up a second one as a vitrual IP and then used that IP 1:1 to the computer I want to use Hamachi on.
So this is a workable situation for me, because I have multiple static IPs. But I have a friend who gets one dynamic IP, and this wouldn't work for him because his PC could do 1:1 but then his other PCs couldn't get out. -
Well I got it working using 1:1. I have multiple static IPs from my ISP. I set up a second one as a vitrual IP and then used that IP 1:1 to the computer I want to use Hamachi on.
So this is a workable situation for me, because I have multiple static IPs. But I have a friend who gets one dynamic IP, and this wouldn't work for him because his PC could do 1:1 but then his other PCs couldn't get out.Understood. I'll work on this for 1.1, the NAT code is so important that we can't really risk breaking it in the middle of the beta cycle (unless it was actually broken).
We have a number of checks in place to stop 1:1 NATs being used on the same external address as an oubound nat, but play around a little bit, I suspect you might be able to create the 1:1, then create an outbound nat using the same address (just using Interface Address). It might work depending on how we order the NATs in the rule file (I can't recall if we put binat first or nat - the order obviously makes a huge difference in packet matching :))
–Bill