Opening the firewall port [new]
-
Your behind a NAT - so your destination is to a private IP that 10.x.x.x on your WAN interface - did you disable block private IPs on the wan interface? See attached pic
I don't see it in your wan rules - so I would have to assume you did. Did you have any other rules on say the floating tab?
Also I would try it without the aliases. Just put in the IP and ports vs using aliases. Does that fix the problem and allow the traffic?
edit: After checking your aliases again - that does not look like a 192 to me. Do you have a typo in your alias?? hard to say with such a small screenshot that I had to zoom in on trying to make it out.
-
-
Gawd it is such a pain in the trying to view your images – have to click into them that opens a new window then zoom in because are thumbnails of what your posting..
If the IP address your trying to forward too is wrong - its not going to work..
I don't see any rules in your floating tab. Did you change your rules to use just IP and port vs aliases?? Why is there anything listed in you NAT rules if your doing automatic NAT. You must of switch to manual at some point?
Delete your current rule and forward - create a NEW forward and let it auto create your wan rule. See below, see how used the actual IP and the actual port number vs alias.
See how when I look at the firewall wan rule shows it associated to port forward. Also delete all the stuff in your NAT section if your going to leave it on auto. And could you please just attach your images? It makes it SO MUCH Easier to view vs some outside place.
-
I tried to follow your instructions and delete all the rules that were in the Outbound table but the 31950 port remains closed. How come?
I have to create some rule in the table Floating? If so, which one?
Thanks
Bye
-
ARGH! Dude did you create a NEW NAT and let it create the rule using IP and Port vs your alias??
That is just clean up work - since from your post you had Auto Checked - so there shouldn't be any rules listed there unless your doing Manual NAT.
NO you don't have to create anything in the floating TAB!
-
ARGH! Dude did you create a NEW NAT and let it create the rule using IP and Port vs your alias??
That is just clean up work - since from your post you had Auto Checked - so there shouldn't be any rules listed there unless your doing Manual NAT.
NO you don't have to create anything in the floating TAB!
I understand that, setting to "Automatic outbound NAT rule generation", I should not create any rule in the table Port Forward but I should only have these settings:
Right?
Unfortunately, the 31950 port is still closed.
Now, where is the error?
Thanks
Bye
-
DONT USE THE FREAKING ALIAS!! How many times do I have to say it???
Put in the ACTUAL PORT and IP
And you don't even show your NAT rule – for all I know you don't have it! Do you still show firewall blocking the port?? Then your nat and rule are NOT being applied.
And if you post one more picture to imageshack -- I am done trying to help you!! It take me 2 freaking clicks and another window trying to make out something that is not even worth looking at.
-
balubeto
Not directly related with the Topic, but, instead of upload the screenshots ti external hosting why don't you upload them directly to the forum ?
when you "reply" you have the "aditional Options" and there you have the option to attach files (images) to your post, please use it instead imageshack.
-
^ exactly!!! Look how easy it is too view that image.. Make it very easy to see what he is talking about and help him, vs have look at another tab, then wait for the stupid flash interface to finish so you can hopefully zoom in 1 click and see something. Just to find out its the same shit you have been posting all along.
The alias tab, and the firewall edit screen not showing anything worth looking at. Your firewall wan rule clearly is not LINKED to your NAT rule like I have said pretty much every single post to do. Use the IP and PORTS, and let the NAT rule create your wan rule! Its that simple. A port forward should take you like 15 seconds to create.
Also your on windows 7 use the snipping tool so you don't have to post the WHOLE screen when you want to show 1 small part of it.
-
I'm sorry but I can not understand anything more because some people say to use only the alias and others say to use direct the IP addresses and ports.
I have an idea: Could someone explain to me how to restore the default values of the 6 tables of the NAT and firewall and how I will have to do to open the 31950 port in incoming and outgoing to a computer that has the IP address 192.168.1.3?
Thanks
Bye
-
What people say to only use alias?? Not in this thread - Delete the freaking rules and put in the ports and IP. You can always move to alias after you have it working. Takes two seconds to change a rule or create or delete one.
The fact that this thread has been going on for days is completely and utterly crazy!
You have shown your firewall log once – clearly your rule was not working or it would not have been blocked by the default rule.
Delete all you wan rules - delete your port forwards. Create a new port forward with allowing it to create you wan rule using IP and ports. Then generate some traffic and see what happens - then we can move on. But with your aliases in there - for all I know you have a space on the end? There is a bug? You had the wrong freaking IP in there to start with 193 vs 192.. So again remove the ALIASES and we can move forward.
And if you post to imageshack I am DONE!! Attach your images to the thread like a normal person ;)
-
Where I'm wrong?
You remember that, in the Pluto computer, I disabled the firewall-software.
Thanks
Bye
-
…......
-
Well from this – pfsense says it passed that traffic.
If you not seeing it open, then tells me your 192.168.1.3 box is not listening on it? Or firewall is blocking it?
What I would do is sniff on the pfsense LAN interface, under diag -- do you see it send the traffic to 192.168.1.3
If so - then .3 is not listening, or you got firewall on it, or something else between pfsense and .3 that is blocking it.
So from pfsense diag, do a packet capture for your IP
And thanks for the attachments in the thread - so much easier to READ!!!
edit: Question for you - you have a nat before pfsense, you sure there is no nat between pfsense and this 192.168.1.3 box? Maybe a wireless router your using and its not configured as access point but natting?
So between .3 and pfsense there is only a normal dumb switch, not acls or anything?
-
Between the Pluto computer and pfSense there is a HP ProCurve 1410-16G switch http://h17007.www1.hp.com/us/en/products/switches/HP_1410_Switch_Series/index.aspx#tab2.
Since in this computer I have an active VNC server on the 5900 port, I tried to capture packets from this port but no packets are captured. How come?
Thanks
Bye
-
don't capture the traffic at the server - capture the traffic on pfsense. You need to verify that its actually putting the packets on the lan network.
What does trying to capture 5900 have to do with your 31950 port? And where are you accessing this 192.168.1.3 server from via vnc? If from the 192.168.1 network no pfsense would never see this traffic.
-
don't capture the traffic at the server - capture the traffic on pfsense. You need to verify that its actually putting the packets on the lan network.
What does trying to capture 5900 have to do with your 31950 port? And where are you accessing this 192.168.1.3 server from via vnc? If from the 192.168.1 network no pfsense would never see this traffic.
I also tried to capture packets on the port 31950 but with the same result.
Since all the computers are on the same network 192.168.1, how do I fix this?
Thanks
Bye
-
So if your not seeing packets on the pfsense lan (capture on pfsense) interface for 31950 once you generate traffic and see a pass in the firewall logs. Then yeah something is not right - something misconfigured.
But I find it hard to believe - I have never had issue one with pfsense and a port forward. Click and its done and works. Its as simple as filling out the port forward page, and letting it configure the wan rule.
So unless your traffic is coming into a different wan interface?? If your not seeing the packets on the lan interface then you have something wrong in your rules plain and simple.
So I would suggest you start a capture on the correct port and 192.168.1.3 address on the pfsense lan interface, and then generate some traffic via canyouseeme.org
Your saying your not seeing this traffic? Do you have more than 1 lan interface?
edit: Tell you what, if you want PM details on how I can remote access your pfsense and I will take a look myself. What your trying to do should take at most 15 seconds to accomplish.