Port forwarding is not working
-
^ exactly!! Unless your controlling the NAT device in front of your pfsense. Then you could forward the ports you want on that device to your pfsense wan IP, and then have pfsense forward that to IP inside your network.
So is your pfsense wan start with 192.168? As mentioned already that is PRIVATE address and not routable on the private network, there is no reason to hide it, just like you didn't hide that your forwarding to 192.168.1.3
What is your pfsense wan IP – lets hope its not also on a 192.168.1. address.
As to doing packet capture on pfsense - its already there, nothing to download its under the diagnostic tab. You would would something to read it with, say wireshark or something. pfsense will report some basic info you do in the capture - but if you want to look at the details you will need to download the capture and open in say wireshark on your PC.
So your saying this worked with UPnP?? Was that before you pfsense was put in? And you were doing UPnP to your ISP provided router??
-
OK…my ISP assigned IP is 192.168.25.179
Yes....if I enable uPnP everything works like a charm for the bit torrent clients.
Also, the World Of Warcraft client P2P also works no problem (even without uPnP) if that helps shed some light.
As always...thank you for your efforts.
Randy
-
You do understand that torrents do work even without inbound ports.. Sorry but even if pfsense uses UPnP to open up the port, that is NOT going to open it up on the NAT in front of you. Now not going to be as fast if you had ports open, because your only seeds. If peers can not ask you for parts of the torrent, and you send them stuff back - then they will shut you down and not share stuff with you. So depending on the seeds/peers of any specific torrent your speeds might be ok, or they might really really blow. But you do not require inbound ports to download stuff.
It is NOT possible to route traffic to 192.168.25.179 over the public internet - its just NOT!!
So you have access to the ISP device your plugging pfsense into? If so then you could put your pfsense wan IP into the DMZ of that device.
To explain this further - go to say http://www.whatsmyip.org/
You get something like Your IP Address is 24.13.xx.xx (mine) at the very top. This is the public IP you use on the internet. Most likely this is the IP either at the wan side of the device your plugging pfsense into or worse case somewhere in side your isp network. BTW do you have a model number of this device, most likely its just a typical home gateway device doing NAT, just like any soho router anyone would use in their home.
So in your setup you get something like this
internet – 24.13.a.b (isp device) 192.168.25.1 -- 192.168.25.179 (pfsense) 192.168.1.1 --- 192.168.1.3 PC running torrent
So you can tell pfsense all day long to forward any traffic it sees on its wan 192.168.25.179 on port 63443 to your PC IP, problem is the isp device at 24.13 gets this unsolicited traffic on 63443 and says nope not in answer to anything clients behind me request = drop!! So pfsense never sees the traffic to forward.
So what you need is access to the isp box and tell it hey ANY unsolicited traffic you see for ANY port!! You send it on to that 192.168.25.179 address. Now pfsense will see it and use its firewall/Nat rules to determine if should drop this traffic or forward it on.
Now if what is happening is NAT is somewhere upstream in the carrier, or you don't have access to that isp device web gui or cli to make adjustments. Then there is just nothing your going to be able to do to get inbound unsolicited traffic like that to work.
-
I do realize that I can still d/l without a port being open but I can't share and end up being penalized. What I still don't understand is if uPnP is enabled I immediately get clients connecting to my machine and uploading.
The ISP provides service by wireless so I don't have a ISP provide router per se. What I do have is a very small power over ethernet box between the pfsense box and the wireless radio on the roof. I don't have access to the webgui address for the radio.
The installer told me that they don't have an issue with torrenting unless you abuse the bandwidth under the Fair Service agreement. So what I'll do at this point is contact tech support and armed with the info you've provided and see what they have to say.
Thank you,
Randy -
Your saying that if you use UPnP with pfsense that it works - or do you mean if you use UPnP when just connected to your ISP device then it works?
-
If I enable uPnP on the pfsense router and enable it within uTorrent then uTorrent passes its internal tests for d/l & u/l and gives a green check mark showing the port is open. Once that's done I see other people connect to my client and I see them uploading.
At this point I have not done anything on the ISP side of the pfsense router.
R
-
Well things seemed to work but after a bit it all seems to die…so just as you said - it's not going to work. I called the ISP and their modem was currently set in 'router' mode. They are going to switch it to 'bridge' mode and I will have to manually enter the WAN IP address to the pfsense router - not a big deal.
I'll update the thread with the, hopefully, successful results. ;D
R
edit Hmmm...hopefully I do that right! Under the WAN interface I'm guessing I set the "Type" to "Static"
-
yeah if they are going to give you a IP to set, then it would be static on the wan interface, you will need the netmask and the gateway address to use as well.
Once you on public on pfsense wan, you should be golden! Please do let us know.
-
The ISP set their radio to bridge mode and gave me the static IP, gateway IP and subnet mask of 255.255.255.0. For the life of me I could not find where to change the subnet and under the Interface Status page the WAN subnet showed 255.255.255.255.
While the tech was on the phone I apologized and asked them to set the radio back to 'router' mode so that I could access the forums and ask how/if it was possible to change the WAN subnet. Unfortunaetly I now could not access the Internet despite being assigned a DHCP address (192.168.25.179)! I called them back and they said they would come out next Teusday…sigh.
Well that wasn't going to cut it for me... but so as not to ramble on too much about my attempts to get things going ;D I ended up plugging in the router that I had setup as a Wireless AP and in trying to reset the wan/lan info it would reset to 10.0.0.0 and the login page was for AirOS (their WebGUI login). Back on the phone to tech....here's a clue for you (ISP) guys and that's when they realized they f&^(&d up the reset. ::) Now that I have internet access again I can start rebuilding my network.
Question is...is it possible to change the WAN subnet from 255.255.255.255 to what they want 255.255.255.0 or is this some oddball setup on their part? If changing it is possible where do I find it?
Thanks so much for all the help…I'm hoping we are seeing the light at the end of the tunnel.
Randy
edit I don't like being a noob :-[ but after plugging in the pfsense router my dhcp assigned address is now 10.0.0.113 and not the 192.168.25.179. I have no ideas of the implication of this but I have internet so I'm not going to touch it just yet..especially now that there will be no tech support for the weekend. If this is BAD please let me know. :-X
-
And that is still a PRIVATE address 10.0.0.113
10.x.x.x, 192.168.x.x and 172.16-31 are all private and put you in same boat.
Did you notice the dropdown where it says /32 – just change that to /24 if they are giving you a 255.255.255.0 mask.
-
Awesome…thank you, I would never have stumbled onto that. I'll give them a call during the week when there is tech support available to change the radio back to bridge mode and I'll let you know how it pans out.
R
-
Well a tech called me on a Sunday! Static IP is setup and port forwarding is working like a charm now. Thank you very much!!
One thing I noticed after the change up the RTT under Gateways went from .25(ish) ms for the dhcp address to 1.5(ish) ms under the static IP. Probably not a big deal…just curious (as always).
So how do I go about buying you a beer? ;D
R
-
sub-1 ms means it was an IP local to you, probably on the radio in that case. The gateway for a real public IP will be upstream somewhere on the provider's network most of the time with a WISP, which is going to take more than 1 ms to get to (laws of physics, speed of radio waves, speed of light in fiber, etc. depending on the circumstance). Several ms wouldn't be uncommon, depends on where that router is and what you have to go through to get there and how congested the provider's network is.
-
Me? You want to buy me a beer? That is very thoughtful, and if you were in the area I would like nothing more to enjoy a cold one with another fan of pfsense.
But I suggest you donate the cost of the beer to pfsense - everyone wins that way.
http://www.pfsense.org/index.php?option=com_content&task=view&id=47&Itemid=77
http://www.pfsense.org/donate.htmlAs cmb mentions, before when you were doing NAT on the device on your roof pfsense gateway was right there local, now its somewhere inside the isp network, so yeah going to be a bit longer rtt to the gateway.
-
A donation has been sent. [Clink of beer glasses] Cheers!
Thank you very much for you help.
Randy
