Pfsense seems to block connection to specific game servers.
-
So here is the thing pfsense default rules outbound are any any.. Why/how you would think that pfsense blocking it is why - have you adjusted the default lan rules?
So how do you have this dd-wrt router setup, "router" mode does not disable wan?? What ports are you connected to on the dd-wrt router? And your using what to play GTA? Xbox like the link you posted talks about..
What is this "modem" you have in front of pfsense – looking at your "modem ---> pfsense ---> ddwrt in "router" mode."
Without some clarification I see 3 nat points, or a triple nat.. Many users call gateway devices "modem" Then you clearly state "router" mode which sure seems to me like your natting. If it was used as just AP why would you say router mode?
Here is the thing does pfsense have public IP on its wan or rfc1918? Why don't you sniff the traffic and see what/where your game is trying to go and what is failing? You can do packet captures under diag on pfsense.
Again unless you changed the default lan rules - they are any any and pfsense would not block anything - so you either have a name resolution problem or a double nat problem trying to use UPnP, etc. etc..
-
1. I just tested this with the xbox hooked up directly to the pfsense router and still had the same issue. I tested other games, including some by the same company (Rockstar) with success on all of them. This is why I believe it is blocking the connection in some way.
2. I changed the DDwrt router to gateway mode, however it works the same in either mode. I realized that router mode does not disable the wan but was in the options, so i disabled it and added the wan port to the switch in order to use it. Yes, an xbox 360 is in use.
3. The modem in from of pfsense is a zyxel C1000Z provided by centurylink for my dsl connection. It is set to transparent bridging mode so the pppoe login is done on the pfsense box.
4. As I listed before i changed it to gateway mode and the firewall was always set to disabled on the ddwrt router. However it could still be natting (do not really know how to check), the list of modes I can switch to are: Gatway, BGP, RIP2 router, OSPF router, vtysh OSPF BGP Rip router, OSLR router and router.
5. I do not know how to check the Ip thing, but the best I can provide you with is under dashboard and interfaces, i see Wan and my public ip listed to the right of it.
6. I did a packet capture, However i'm not too good at reading the output. Ill look for tutorials while I await a response on the last 5 questions and hopefully answers I provided. Thanks for helping.
-
1. I just tested this with the xbox hooked up directly to the pfsense router and still had the same issue. I tested other games, including some by the same company (Rockstar) with success on all of them. This is why I believe it is blocking the connection in some way.
If pfSense is blocking, it will show up in the logs.
2. I changed the DDwrt router to gateway mode, however it works the same in either mode. I realized that router mode does not disable the wan but was in the options, so i disabled it and added the wan port to the switch in order to use it. Yes, an xbox 360 is in use.
I have never used ddwrt. What you want is Bridge or Access Point mode, whatever they call it. I can't fathom the difference between router and gateway mode so…
3. The modem in from of pfsense is a zyxel C1000Z provided by centurylink for my dsl connection. It is set to transparent bridging mode so the pppoe login is done on the pfsense box.
Precisely what you want.
4. As I listed before i changed it to gateway mode and the firewall was always set to disabled on the ddwrt router. However it could still be natting (do not really know how to check), the list of modes I can switch to are: Gatway, BGP, RIP2 router, OSPF router, vtysh OSPF BGP Rip router, OSLR router and router.
You can check by seeing if the wireless clients are receiving DHCP from pfSense or ddwrt. Either the wireless clients are on the same subnet as the pfSense LAN interface or they're not.
5. I do not know how to check the Ip thing, but the best I can provide you with is under dashboard and interfaces, i see Wan and my public ip listed to the right of it.
Good to go.
6. I did a packet capture, However i'm not too good at reading the output. Ill look for tutorials while I await a response on the last 5 questions and hopefully answers I provided. Thanks for helping.
You are looking for traffic to the game server. I have no idea what DNS name GTA5 is going to try to connect to. I would capture traffic on the LAN, isolate the Xbox IP address, and see what it's doing. You should be able to get at the DNS query for the game server. Then I would capture traffic on WAN and look for traffic to that server and see what's what. Not a gamer so I don't know if you're looking for TCP or UDP traffic or what.
You can always download the capture and upload it. Wireshark can read them. I'd be happy to look at it.
-
Does this game need UPnP or any specific rules inbound on WAN? Are there correlating blocks inbound on WAN when you're trying to start the game?
-
For the ddwrt mode problem this is the guide I followed http://www.dd-wrt.com/wiki/index.php/Wireless_Access_Point (sorry for posting links to what could be considered a competing firmware).
The dhcp on the ddwrt router is disabled, all the clients are being assigned ip's from pfsense.
I dont know if it could be a problem, but I am using googles DNS. 8.8.8.8 and 8.8.4.4. Another thing is I have added HAVP antivirus and squid cashing to the pfsense box. I have tried to connect with the antivirus disabled, but the cashing service I left up.
I have have uploaded the packet capture of the xbox trying to connect to the GTA servers. I had to upload it as a .txt because this forum does not allow .cap uploads. I tried to connect 2-3 times so there should be a pattern to it. Thank you all again.
[packet cap.txt](/public/imported_attachments/1/packet cap.txt)
-
Does this game need UPnP or any specific rules inbound on WAN? Are there correlating blocks inbound on WAN when you're trying to start the game?
I have tried to use the second method listed in the link in my first post, and when i tried to packet capture on the lan (if this is what you mean) it was blank.
-
while that packet capture gives us some ips and ports being used - its kind of useless to be honest.. DOWNLOAD the capture, post that - so we can see some details of what is going on. From that capture your 192.168.1.4 is your xbox?
I would take it this is the network your saying you can not talk too?
NetRange: 192.81.240.0 - 192.81.247.255
CIDR: 192.81.240.0/21
OrgName: TAKE-TWO INTERACTIVE SOFTWARE, INC.Clearly there is something going on – but without the actual download of the capture is very difficult to say what..
As to dd-wrt being competitive with pfsense? Ummm no not really - while they are firewall/router software, dd-wrt is specific hardware software for off the shelf soho devices - pfsense would not run on 99% of the hardware that dd-wrt runs on.. Maybe even all of it - but I do think there is a x86 port.. So maybe that could run on the same hardware ;)
I don't think anyone is going to have issues with talking about dd-wrt in trying to fix your issue ;)
-
I kind of figured people would assume ddwrt was the problem, so I am glad I did the test removing it as the middleman. As for the .cap file, this forum only allows "Allowed file types: txt, jpg, gif, png, xls." I suppose i could change the extension to a .txt and the downloader could change it back. If that does not work, Ill upload it to a hosting website like mediafire or alike.
This is a .cap file, just remove the .txt I added on to the end.
-
Running any packages, like snort?
-
I have two packages, HVAP antivirus and Squid caching. I ran a test where I disabled HVAP antivirus, however, I did not disable Squid caching.
-
Squid can easily break things. Often hurts more than it helps.
-
^ agreed, I don't see the need of proxy in home setup. Going to cause you more problems than any sort of advantage, etc.
Clearly you have a issue with squid and what your trying to do
-
Alright, ill disable that and try it.
-
Yup, that is what did it. I disabled squid and it works now. I do find it strange that it is the only game that has issues. I would enjoy the caching service, but the internet here is above average. Thank you all so much for the help. I really appreciate it and am so, so happy I do not have to ditch pfsense, it is much too awesome to leave behind over one game.
-
Squid often breaks lots of stuff - Not just games.
Glad you figured it out.
-
I deal with proxy all the time, and for a couple of years that is all I did support a global user base web content filtering, 15k plus users - and I can tell you proxies break shit ;) hehehe
