Pfsense seems to block connection to specific game servers.
-
My brother is trying to connect to Grand Theft Auto 5 multiplayer only to receive the message "Rockstar game services are unavailable right now." My current setup is such: modem –-> pfsense ---> ddwrt in "router" mode. I have tried to fix this in several ways including the first two methods posted on this topic "https://forum.pfsense.org/index.php?topic=13887.0." There were several other methods posted that i have tried but cannot remember them all, none of them have been specifically targeted at Rockstar game services. To answer a possible question, yes, it was working before this. Thanks in advance.
-
How do you know it's not ddwrt blocking it? Why are you going through two routers?
-
Ddwrt has never blocked it before. I am using an old pc with only two gigabit ports as the main router and the ddwrt router as the access point.I suppose i should have added that it was previously the main router.
-
Take the ddwrt out of router mode and try setting it up like this:
https://forum.pfsense.org/index.php?topic=81014.0
-
That is the setup i have at the moment, It says router mode but that is the mode that disables wan. Sorry to post about ddwrt on the pfsense fourm, but i do not believe that is the problem. Everything else is working. Only rockstar online is having issues.
-
Look in the firewall logs for blocked packets then find the rules that are blocking them.
-
I had my brother try to connect, there was nothing added to the firewall log unless the log does not update instantly.
-
Then it wasn't blocked by pfSense.
-
Well it is the only thing that has changed. Ill have to remove it if I cannot fix it.
-
You gotta do what you gotta do.
If you eliminate the ddwrt and the wifi and plug in wired do you see the same symptoms?
Have you tried simple tests like digging the host address, pinging it, and making sure that everything is as it's supposed to be?
-
So here is the thing pfsense default rules outbound are any any.. Why/how you would think that pfsense blocking it is why - have you adjusted the default lan rules?
So how do you have this dd-wrt router setup, "router" mode does not disable wan?? What ports are you connected to on the dd-wrt router? And your using what to play GTA? Xbox like the link you posted talks about..
What is this "modem" you have in front of pfsense – looking at your "modem ---> pfsense ---> ddwrt in "router" mode."
Without some clarification I see 3 nat points, or a triple nat.. Many users call gateway devices "modem" Then you clearly state "router" mode which sure seems to me like your natting. If it was used as just AP why would you say router mode?
Here is the thing does pfsense have public IP on its wan or rfc1918? Why don't you sniff the traffic and see what/where your game is trying to go and what is failing? You can do packet captures under diag on pfsense.
Again unless you changed the default lan rules - they are any any and pfsense would not block anything - so you either have a name resolution problem or a double nat problem trying to use UPnP, etc. etc..
-
1. I just tested this with the xbox hooked up directly to the pfsense router and still had the same issue. I tested other games, including some by the same company (Rockstar) with success on all of them. This is why I believe it is blocking the connection in some way.
2. I changed the DDwrt router to gateway mode, however it works the same in either mode. I realized that router mode does not disable the wan but was in the options, so i disabled it and added the wan port to the switch in order to use it. Yes, an xbox 360 is in use.
3. The modem in from of pfsense is a zyxel C1000Z provided by centurylink for my dsl connection. It is set to transparent bridging mode so the pppoe login is done on the pfsense box.
4. As I listed before i changed it to gateway mode and the firewall was always set to disabled on the ddwrt router. However it could still be natting (do not really know how to check), the list of modes I can switch to are: Gatway, BGP, RIP2 router, OSPF router, vtysh OSPF BGP Rip router, OSLR router and router.
5. I do not know how to check the Ip thing, but the best I can provide you with is under dashboard and interfaces, i see Wan and my public ip listed to the right of it.
6. I did a packet capture, However i'm not too good at reading the output. Ill look for tutorials while I await a response on the last 5 questions and hopefully answers I provided. Thanks for helping.
-
1. I just tested this with the xbox hooked up directly to the pfsense router and still had the same issue. I tested other games, including some by the same company (Rockstar) with success on all of them. This is why I believe it is blocking the connection in some way.
If pfSense is blocking, it will show up in the logs.
2. I changed the DDwrt router to gateway mode, however it works the same in either mode. I realized that router mode does not disable the wan but was in the options, so i disabled it and added the wan port to the switch in order to use it. Yes, an xbox 360 is in use.
I have never used ddwrt. What you want is Bridge or Access Point mode, whatever they call it. I can't fathom the difference between router and gateway mode so…
3. The modem in from of pfsense is a zyxel C1000Z provided by centurylink for my dsl connection. It is set to transparent bridging mode so the pppoe login is done on the pfsense box.
Precisely what you want.
4. As I listed before i changed it to gateway mode and the firewall was always set to disabled on the ddwrt router. However it could still be natting (do not really know how to check), the list of modes I can switch to are: Gatway, BGP, RIP2 router, OSPF router, vtysh OSPF BGP Rip router, OSLR router and router.
You can check by seeing if the wireless clients are receiving DHCP from pfSense or ddwrt. Either the wireless clients are on the same subnet as the pfSense LAN interface or they're not.
5. I do not know how to check the Ip thing, but the best I can provide you with is under dashboard and interfaces, i see Wan and my public ip listed to the right of it.
Good to go.
6. I did a packet capture, However i'm not too good at reading the output. Ill look for tutorials while I await a response on the last 5 questions and hopefully answers I provided. Thanks for helping.
You are looking for traffic to the game server. I have no idea what DNS name GTA5 is going to try to connect to. I would capture traffic on the LAN, isolate the Xbox IP address, and see what it's doing. You should be able to get at the DNS query for the game server. Then I would capture traffic on WAN and look for traffic to that server and see what's what. Not a gamer so I don't know if you're looking for TCP or UDP traffic or what.
You can always download the capture and upload it. Wireshark can read them. I'd be happy to look at it.
-
Does this game need UPnP or any specific rules inbound on WAN? Are there correlating blocks inbound on WAN when you're trying to start the game?
-
For the ddwrt mode problem this is the guide I followed http://www.dd-wrt.com/wiki/index.php/Wireless_Access_Point (sorry for posting links to what could be considered a competing firmware).
The dhcp on the ddwrt router is disabled, all the clients are being assigned ip's from pfsense.
I dont know if it could be a problem, but I am using googles DNS. 8.8.8.8 and 8.8.4.4. Another thing is I have added HAVP antivirus and squid cashing to the pfsense box. I have tried to connect with the antivirus disabled, but the cashing service I left up.
I have have uploaded the packet capture of the xbox trying to connect to the GTA servers. I had to upload it as a .txt because this forum does not allow .cap uploads. I tried to connect 2-3 times so there should be a pattern to it. Thank you all again.
[packet cap.txt](/public/imported_attachments/1/packet cap.txt)
-
Does this game need UPnP or any specific rules inbound on WAN? Are there correlating blocks inbound on WAN when you're trying to start the game?
I have tried to use the second method listed in the link in my first post, and when i tried to packet capture on the lan (if this is what you mean) it was blank.
-
while that packet capture gives us some ips and ports being used - its kind of useless to be honest.. DOWNLOAD the capture, post that - so we can see some details of what is going on. From that capture your 192.168.1.4 is your xbox?
I would take it this is the network your saying you can not talk too?
NetRange: 192.81.240.0 - 192.81.247.255
CIDR: 192.81.240.0/21
OrgName: TAKE-TWO INTERACTIVE SOFTWARE, INC.Clearly there is something going on – but without the actual download of the capture is very difficult to say what..
As to dd-wrt being competitive with pfsense? Ummm no not really - while they are firewall/router software, dd-wrt is specific hardware software for off the shelf soho devices - pfsense would not run on 99% of the hardware that dd-wrt runs on.. Maybe even all of it - but I do think there is a x86 port.. So maybe that could run on the same hardware ;)
I don't think anyone is going to have issues with talking about dd-wrt in trying to fix your issue ;)
-
I kind of figured people would assume ddwrt was the problem, so I am glad I did the test removing it as the middleman. As for the .cap file, this forum only allows "Allowed file types: txt, jpg, gif, png, xls." I suppose i could change the extension to a .txt and the downloader could change it back. If that does not work, Ill upload it to a hosting website like mediafire or alike.
This is a .cap file, just remove the .txt I added on to the end.
-
Running any packages, like snort?
-
I have two packages, HVAP antivirus and Squid caching. I ran a test where I disabled HVAP antivirus, however, I did not disable Squid caching.
