Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Hamachi

    Scheduled Pinned Locked Moved General pfSense Questions
    51 Posts 10 Posters 31.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sullrich
      last edited by

      Isn't hamachi using UDP?  Perhaps my screenshot was wrong in this regard.  Please remove nat+firewall rules and start over but use UDP.

      Scott

      1 Reply Last reply Reply Quote 0
      • C
        CrashX
        last edited by

        I don't see that Outbound Nat let's you choose between UDP and TCP.

        1 Reply Last reply Reply Quote 0
        • S
          sullrich
          last edited by

          Well then verify the outbound rule is the first in the list before all other rules.

          1 Reply Last reply Reply Quote 0
          • M
            MikaelS
            last edited by

            @sullrich:

            Well then verify the outbound rule is the first in the list before all other rules.

            Thats what i have done (hamachi NAT rule is at top).
            But it isent working.
            No Firewall rules needed?? or anything else?

            Happy new year to all!

            1 Reply Last reply Reply Quote 0
            • S
              sullrich
              last edited by

              Okay, time to install this beast.

              Can you tell me how we can get a tunnel connected for testing?

              1 Reply Last reply Reply Quote 0
              • C
                CrashX
                last edited by

                I created one for testing.

                Network name: pfsense
                Password: pfsense

                1 Reply Last reply Reply Quote 0
                • C
                  CrashX
                  last edited by

                  It should turn green if the connection is good. Yellow if there is a problem.

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by

                    Edit the outgoing rule and remove the source port.

                    Then make sure the magic option is enabled in Hamachi.

                    1 Reply Last reply Reply Quote 0
                    • S
                      sullrich
                      last edited by

                      Well as a follow up, I tried to set it up at my work and home (both running pfSense).

                      No matter what I tried, I could not get it working.

                      Sorry!

                      1 Reply Last reply Reply Quote 0
                      • C
                        CrashX
                        last edited by

                        I have been trying everything suggested, without any luck.

                        1 Reply Last reply Reply Quote 0
                        • S
                          sullrich
                          last edited by

                          @CrashX:

                          I have been trying everything suggested, without any luck.

                          I tired manually entering every combo of rule found in the Hamachi forum and nothing seems to work.

                          Not really sure whats going on, the Hamachi developers are going to have to give us better examples of how to make this work and they will also need to clarify why they feel that PF "over locks nat" down.

                          1 Reply Last reply Reply Quote 0
                          • B
                            billm
                            last edited by

                            I'll poke at this over the weekend and see if I can figure out what's wrong with the NAT.  We aren't using static-port as they suggest, but we should have been forcing the source port to be what was specified.

                            –Bill

                            pfSense core developer
                            blog - http://www.ucsecurity.com/
                            twitter - billmarquette

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by

                              I got it working with a 1:1.

                              • Remove all prior outbound nat rules and nat port forwards pertaining to Hamachi previously setup

                              • Add a Firewall -> NAT -> 1:1 to your computer

                              • enable magic option in Hamachi

                              • add a firewall rule to the magic port with your internal ip.  the default is 12975

                              1 Reply Last reply Reply Quote 0
                              • B
                                billm
                                last edited by

                                Erg, I hate to reply w/in an hour of the last reply, but I think I see the problem.  We are going to need static-port, the implementation of that will need to be somewhat carefully thought out as it's very easy to hose stuff up (windows doesn't use terribly random source ports, conflicts are guaranteed).  1:1 nat (for those with more than one IP) might be an option - or for those with only one machine behind pfsense.

                                –Bill

                                pfSense core developer
                                blog - http://www.ucsecurity.com/
                                twitter - billmarquette

                                1 Reply Last reply Reply Quote 0
                                • M
                                  MikaelS
                                  last edited by

                                  I must thank you all for testing this, i know that you all have limited time for supporting something that isent pfsense specific.
                                  This is much appreciated!

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    CrashX
                                    last edited by

                                    Well I got it working using 1:1. I have multiple static IPs from my ISP. I set up a second one as a vitrual IP and then used that IP 1:1 to the computer I want to use Hamachi on.
                                    So this is a workable situation for me, because I have multiple static IPs. But I have a friend who gets one dynamic IP, and this wouldn't work for him because his PC could do 1:1 but then his other PCs couldn't get out.

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      billm
                                      last edited by

                                      @CrashX:

                                      Well I got it working using 1:1. I have multiple static IPs from my ISP. I set up a second one as a vitrual IP and then used that IP 1:1 to the computer I want to use Hamachi on.
                                      So this is a workable situation for me, because I have multiple static IPs. But I have a friend who gets one dynamic IP, and this wouldn't work for him because his PC could do 1:1 but then his other PCs couldn't get out.

                                      Understood.  I'll work on this for 1.1, the NAT code is so important that we can't really risk breaking it in the middle of the beta cycle (unless it was actually broken).

                                      We have a number of checks in place to stop 1:1 NATs being used on the same external address as an oubound nat, but play around a little bit, I suspect you might be able to create the 1:1, then create an outbound nat using the same address (just using Interface Address).  It might work depending on how we order the NATs in the rule file (I can't recall if we put binat first or nat - the order obviously makes a huge difference in packet matching :))

                                      –Bill

                                      pfSense core developer
                                      blog - http://www.ucsecurity.com/
                                      twitter - billmarquette

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        sullrich
                                        last edited by

                                        Only one of you needs to do the 1:1 trick.

                                        I left my work machine off of a 1:1 and I am still green to it.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          MikaelS
                                          last edited by

                                          I see that you are working on som static port? http://cvstrac.pfsense.com/chngview?cn=9024

                                          Is this a solution to the Hamachi problem??

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            sullrich
                                            last edited by

                                            Yep

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.