Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Attempting to port forward with an OpenVPN client [SOLVED]

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 4 Posters 18.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wallabybob
      last edited by

      I suspect your firewall rule for port 8462 is wrong but I don't know enough about your configuration. If you re really doing port forwarding (rather than routing) then the destination IP address in an incoming (on the WAN interface) connection to your server won't have a destination IP address = the server address, the destination IP address will probably be the WAN interface IP address.

      Further, the destination address in the rule is a private IP address so it will match the first rule and hence will be blocked.

      1 Reply Last reply Reply Quote 0
      • chpalmerC
        chpalmer
        last edited by

        I did not see an option to enable logging for this specific rule.

        Look at my example above.  The arrow points to the logging which is found on the firewall rule.

        I suspect your firewall rule for port 8462 is wrong but I don't know enough about your configuration. If you re really doing port forwarding (rather than routing) then the destination IP address in an incoming (on the WAN interface) connection to your server won't have a destination IP address = the server address, the destination IP address will probably be the WAN interface IP address.

        Further, the destination address in the rule is a private IP address so it will match the first rule and hence will be blocked.

        When you do a port forward- that is the way the associated rule is written by the box. Works here.

        Triggering snowflakes one by one..
        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

        1 Reply Last reply Reply Quote 0
        • chpalmerC
          chpalmer
          last edited by

          Ive got a feeling that on your WAN rule that the Gateway needs to be associated with the VPN but logging will help to see if anything is making it.

          Triggering snowflakes one by one..
          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

          1 Reply Last reply Reply Quote 0
          • W
            wallabybob
            last edited by

            @chpalmer:

            When you do a port forward- that is the way the associated rule is written by the box. Works here.

            Yes, you are correct. My mistake

            But then, won't first firewall rule on the WAN interface block the (attempted) port forward?

            1 Reply Last reply Reply Quote 0
            • chpalmerC
              chpalmer
              last edited by

              @wallabybob:

              @chpalmer:

              When you do a port forward- that is the way the associated rule is written by the box. Works here.

              Yes, you are correct. My mistake

              But then, won't first firewall rule on the WAN interface block the (attempted) port forward?

              I see what your saying..  Doesn't affect me here.  I think that means initiated from a private network…

              Triggering snowflakes one by one..
              Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

              1 Reply Last reply Reply Quote 0
              • T
                thermo
                last edited by

                Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                1 Reply Last reply Reply Quote 0
                • E
                  esde
                  last edited by

                  @thermo:

                  Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                  Thank you sir, for your time and help!!! The port is now forwarded!!!  ;D ;D ;D

                  Also, thank you to chpalmer and and wallabybob!!!

                  1 Reply Last reply Reply Quote 0
                  • chpalmerC
                    chpalmer
                    last edited by

                    Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                    Of coarse!  ::)    (hanging head in shame)

                    Awsome- glad you got it going!  And thanks Thermo!  :)

                    Triggering snowflakes one by one..
                    Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                    1 Reply Last reply Reply Quote 0
                    • W
                      wallabybob
                      last edited by

                      @chpalmer:

                      Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                      Of coarse!   ::)    (hanging head in shame)

                      You weren't the only one. I thought since the port forward was on the WAN it must be a new problem. Details!

                      1 Reply Last reply Reply Quote 0
                      • chpalmerC
                        chpalmer
                        last edited by

                        The actual interface is the VPN so the rule applies there.

                        Even though its a WAN connection the VPN passes through it and is therefore encrypted.

                        Triggering snowflakes one by one..
                        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.