Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwarding help needed from Wolf666

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    34 Posts 4 Posters 6.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      So what is the topology?

      Did you create an OpenVPN client connection to AIRVPN?

      Do you want to listen for inbound connections on that AIRVPN interface and port-forward those connections to a server on LAN?

      You might have to provide a detailed diagram.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • W
        Wolf666
        last edited by

        Here my home network (pfSense 2.2Beta, 15OCT, based on Supermicro A1SRi-2558, 8GBRAM, 4xI354 NIC):

        All clients connected to VPN interface (192.168.2.0/24 subnet) succesfully connect to AirVPN.

        Yes I would like to listen for incoming connection on AIRVPN interface and port forward to LAN (192.168.2.0/24 subnet).

        VPN Client runs with the custom option: route-nopull.

        For your information, I have working port forwardings redirecting WAN to the clear net interface (192.168.1.0/24 subnet, as showed in my diagram).

        Thanks

        PS
        It seems some other airvpn users are having the same problem: https://forum.pfsense.org/index.php?topic=82937.0

        Modem Draytek Vigor 130
        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
        Switch Cisco SG350-10
        AP Netgear R7000 (Stock FW)
        HTPC Intel NUC5i3RYH
        NAS Synology DS1515+
        NAS Synology DS213+

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          So let me upload a diagram and see if I understand the problem.

          Ignore pfSense B and C.

          You want:

          pfSense A to establish a client connection to AIRVPN.

          Create a port forward for incoming connections on pfSense A's AIRVPN address:5678 forwarded to host A2:5678

          Is this correct?

          pfSense+AIRVPN.png
          pfSense+AIRVPN.png_thumb

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • W
            Wolf666
            last edited by

            @Derelict:

            You want:

            pfSense A to establish a client connection to AIRVPN.

            Create a port forward for incoming connections on pfSense A's AIRVPN address:5678 forwarded to host A2:5678

            Is this correct?

            pfSense already establishes a client connection to AIRVPN servers, it works flawlessly, host A2 accesses internet via AIRVPN.

            Now a need to allow incoming connections on pfSense A's AIRVPN address:5678 forwarded to host A2:5678

            Modem Draytek Vigor 130
            pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
            Switch Cisco SG350-10
            AP Netgear R7000 (Stock FW)
            HTPC Intel NUC5i3RYH
            NAS Synology DS1515+
            NAS Synology DS213+

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              This is going to take me some time (probably days) to actually mock up.

              Two things I would check:

              You assigned an interface to the AIRVPN ovpncx instance
              Rules on OpenVPN tab don't match traffic in question.

              pfSense 2.1 book section: “NAT with OpenVPN Connections”

              Excerpt From: Jim Pingle. “pfSense-2.1-book.epub.” iBooks. https://itunes.apple.com/WebObjects/MZStore.woa/wa/viewBook?id=3AC70C08837752AA49E641D5CEB871FE

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • W
                Wolf666
                last edited by

                Rules on OpenVPN tab don't match traffic in question.

                I have no rules on OpenVPN tab. The only rules are on AIRVPN_WAN tab and VPN tab (VPN is the name of the former interface OPT1) and the others related to WAN and LAN (at this stage DMZ interface, former OPT2, is off) to allow clear-internet and client subnet communication.

                I followed  these steps (brilliantly explained in https://airvpn.org/topic/11245-how-to-set-up-pfsense-21-for-airvpn/ ) :

                1 - I assigned the interface AIRVPN_WAN to ovpnc()
                2 - Created Gateway:

                Interface = [AirVPN_WAN ▼]
                Address Family = [IPv4 ▼]
                Name = [✎ AirVPN_WAN]
                Gateway = [dynamic]
                Default Gateway = [] (UNCHECKED)
                Disable Gateway Monitoring = [
                ]
                Monitor IP = [10.4.0.1]
                Advanced = Unchanged
                Description = [✎ AirVPN_WAN Gateway]

                3 - Created Outbound Nat in order to route all traffic initiated in interface VPN (subnet 192.168.2.0/24) to use gateway AIRVPN_WAN

                D

                (unchecked)

                Interface = [ AirVPN_WAN ▼]
                Protocol = [ Any ▼]
                Source = Type: [ Network ▼]
                              Address: [ 192.168.2.0 ] / [ 24 ▼]
                              Source port: [_____] (empty/blank)
                Destination: Type = [ Any ▼]
                Translation: Address = [ Interface Address ]
                Description = [ AirVPN_LAN -> AirVPN_WAN ]

                4 - Created some firewall rules to avoid DNS Leak and pass VPN LAN traffic.

                Action = [ Block ▼]
                Disabled = [] Disable this rule (UNCHECKED)
                Interface = [VPN ▼]
                TCP/IP Version = [IPv4 ▼]
                Protocol = [TCP/UDP ▼]
                Source = [
                ] Not    (UNCHECKED)
                              Type: [ Any ▼]
                              Address: [______] (BLANK)
                Destination = [✔] Not    (CHECKED)
                                    Type: [ Single host or alias ▼]
                                    Address: [10.4.0.1]
                Destination port range = From: [ DNS ▼]
                                                      To: [ DNS ▼]
                Log = [✔] (CHECKED)
                Description = [✎ BLOCK_DNS_LEAKS_VPN]
                [ADVANCED FEATURES]  >  GATEWAY = [ AirVPN_WAN ▼]

                –-------------------------------------------------------------------------------------------

                Action = [ Pass ▼]
                Disabled = [] Disable this rule (UNCHECKED)
                Interface = [VPN ▼]
                TCP/IP Version = [IPv4 ▼]
                Protocol = [Any ▼]
                Source = [
                ] Not (UNCHECKED)
                              Type: [ VPN Subnet ▼]
                              Address: [] (BLANK)
                Destination = [
                ] Not (UNCHECKED)
                                    Type: [ Any ▼]
                                    Address: [
                ] (BLANK)
                Log = [
                ] (UNCHECKED)
                Description = [✎ Allow AirVPN_LAN Outbound]
                [ADVANCED FEATURES]  >  GATEWAY = [ AirVPN_WAN ▼]

                I am a Gold Member, I am already reading the pfSense Book. Please take in consideration I am being using pfSense for 10 days….I have built my own appliance. I am an hobbyist with some skills (I came from several years of openWRT / DD-WRT routers) but totally new on pfSense.

                Thank you very much for your time, I will continue to make my tests and read logs.

                Modem Draytek Vigor 130
                pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                Switch Cisco SG350-10
                AP Netgear R7000 (Stock FW)
                HTPC Intel NUC5i3RYH
                NAS Synology DS1515+
                NAS Synology DS213+

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  What are your rules on the AIRVPN_WAN interface?

                  What are your rules on the OpenVPN Tab?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • W
                    Wolf666
                    last edited by

                    @Derelict:

                    What are your rules on the AIRVPN_WAN interface?

                    What are your rules on the OpenVPN Tab?

                    Since I cancelled the Port forwardings rules, for both:

                    "No rules are currently defined for this interface
                    All incoming connections on this interface will be blocked until you add pass rules."

                    Now I setup the port forwarding and I report back in minutes

                    Modem Draytek Vigor 130
                    pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                    Switch Cisco SG350-10
                    AP Netgear R7000 (Stock FW)
                    HTPC Intel NUC5i3RYH
                    NAS Synology DS1515+
                    NAS Synology DS213+

                    1 Reply Last reply Reply Quote 0
                    • W
                      Wolf666
                      last edited by

                      Port Forward

                      AIRVPN_WAN TCP * * AIRVPN_WAN address 9091 192.168.2.10 9091

                      Firewall (AIRVPN_WAN Tab):

                      IPv4 TCP * * 192.168.2.10 9091 AIRVPN_WAN none

                      Firewall (OpenVPN Tab):

                      No rules are currently defined for this interface
                      All incoming connections on this interface will be blocked until you add pass rules.

                      For info the port forwarding:
                      WAN TCP * * WAN address 21000 192.168.1.6 11678

                      With firewall rule on WAN tab:
                      IPv4 TCP * * 192.168.1.6 11678 * none

                      Works.

                      The default gateway is WAN (*)

                      Modem Draytek Vigor 130
                      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                      Switch Cisco SG350-10
                      AP Netgear R7000 (Stock FW)
                      HTPC Intel NUC5i3RYH
                      NAS Synology DS1515+
                      NAS Synology DS213+

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Firewall (AIRVPN_WAN Tab):

                        IPv4 TCP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

                        Try getting rid of that gateway and setting the rule to default.  That's wrong.  That says that traffic received by pfSense in interface AIRVPN_WAN (from AIRVPN) should use AIRVPN_WAN as the gateway.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • W
                          Wolf666
                          last edited by

                          @Derelict:

                          Firewall (AIRVPN_WAN Tab):

                          IPv4 TCP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

                          Try getting rid of that gateway and setting the rule to default.  That's wrong.  That says that traffic received by pfSense in interface AIRVPN_WAN (from AIRVPN) should use AIRVPN_WAN as the gateway.

                          OK modification done

                          IPv4 TCP/UDP * * 192.168.2.10 9091 * none

                          Looking at Firewall log:

                          PASS - Oct 16 20:49:08 AIRVPN_WAN USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454           192.168.2.10:9091 TCP:S

                          PASS - Oct 16 20:48:55 AIRVPN_WAN USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755           192.168.2.10:9091 UDP

                          BLOCK - Oct 16 20:50:41 VPN Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454 TCP:SA

                          BLOCK - Oct 16 20:49:53 Direction=OUT WAN Default deny rule IPv4 (1000000102)  192.168.2.10:9091     95.211.138.143:36454 TCP:SA

                          So the Port forwarding rule is correctly applied but the acknowledgement is blocked.

                          TCP:SA is blocked because of the following:

                          Outbound NAT

                          PASS AIRVPN_WAN 192.168.2.0/24 * * * AIRVPN_WAN address *

                          Firewall Rule (VPN Tab)

                          BLOCK IPv4 TCP/UDP * * ! 10.4.0.1 53 (DNS) AIRVPN_WAN_GW none
                          PASS IPv4 TCP/UDP VPN net * * * AIRVPN_WAN_GW none

                          Basically I created my Home Lan in order to allow clients connected to VPN interface to go through AIRVPN Tunnel always, using AIRVPN DNS only.

                          I thought TCP:SA was routed via established tunnel as well, automatically.

                          Modem Draytek Vigor 130
                          pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                          Switch Cisco SG350-10
                          AP Netgear R7000 (Stock FW)
                          HTPC Intel NUC5i3RYH
                          NAS Synology DS1515+
                          NAS Synology DS213+

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            The times on that log snippet don't make a lot of sense.

                            PASS - Oct 16 20:49:08  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454            192.168.2.10:9091  TCP:S

                            PASS - Oct 16 20:48:55  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755            192.168.2.10:9091  UDP

                            BLOCK - Oct 16 20:50:41  VPN  Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454  TCP:SA

                            BLOCK - Oct 16 20:49:53  Direction=OUT WAN  Default deny rule IPv4 (1000000102)  192.168.2.10:9091      95.211.138.143:36454  TCP:SA

                            There's like minutes between the S and SA in that log snippet.

                            If you look at Diagnostics->States and filter on 192.168.2.10 or maybe 9091, what states are there when the VPN client is trying to connect inbound on 9091?

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • W
                              Wolf666
                              last edited by

                              Here the states:

                              AIRVPN_WAN udp 192.168.2.10:9091 (10.4.102.214:9091) <- 95.211.138.143:47494 NO_TRAFFIC:SINGLE

                              VPN udp 95.211.138.143:47494 -> 192.168.2.10:9091 SINGLE:NO_TRAFFIC

                              Modem Draytek Vigor 130
                              pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                              Switch Cisco SG350-10
                              AP Netgear R7000 (Stock FW)
                              HTPC Intel NUC5i3RYH
                              NAS Synology DS1515+
                              NAS Synology DS213+

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                I'm confused now.  Is this TCP or UDP traffic you're trying to forward.  When you tried it that time were there any firewall log hits?

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • W
                                  Wolf666
                                  last edited by

                                  @Derelict:

                                  I'm confused now.  Is this TCP or UDP traffic you're trying to forward.  When you tried it that time were there any firewall log hits?

                                  Sorry it was midnight in Italy …. and I made some confusion. My goal is to forward both TCP/UDP as suggested by AirVPN. I did that in the past with iptables.

                                  Back to the problem

                                  Settings:

                                  PF

                                  AIRVPN_WAN  TCP/UDP  *  *  AIRVPN_WAN address  9091  192.168.2.10  9091

                                  Firewall (AIRVPN_WAN Tab):

                                  IPv4 TCP/UDP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

                                  Firewall LOG

                                  PASS - Oct 16 20:49:08  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454            192.168.2.10:9091  TCP:S

                                  PASS - Oct 16 20:48:55  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755            192.168.2.10:9091  UDP

                                  BLOCK - Oct 16 20:50:41  VPN  Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454  TCP:SA

                                  BLOCK - Oct 16 20:49:53  Direction=OUT WAN  Default deny rule IPv4 (1000000102)  192.168.2.10:9091      95.211.138.143:36454  TCP:SA

                                  State

                                  AIRVPN_WAN  udp  192.168.2.10:9091 (10.4.102.214:9091) <- 95.211.138.143:47494  NO_TRAFFIC:SINGLE

                                  VPN  udp  95.211.138.143:47494 -> 192.168.2.10:9091  SINGLE:NO_TRAFFIC

                                  Modem Draytek Vigor 130
                                  pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                  Switch Cisco SG350-10
                                  AP Netgear R7000 (Stock FW)
                                  HTPC Intel NUC5i3RYH
                                  NAS Synology DS1515+
                                  NAS Synology DS213+

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    Wolf666
                                    last edited by

                                    Can be releted to that bug: https://redmine.pfsense.org/issues/3760 ?

                                    I am using 2.2Beta (16OCT)

                                    Modem Draytek Vigor 130
                                    pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                    Switch Cisco SG350-10
                                    AP Netgear R7000 (Stock FW)
                                    HTPC Intel NUC5i3RYH
                                    NAS Synology DS1515+
                                    NAS Synology DS213+

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      I had no idea This was 2.2.  Sorry.  Can't help with that.  there's a 2.2 feedback and problems thread for 2.2 feedback.  I don't know if it's a problem or if there's something misconfigured but I'm staying away from 2.2  no time.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        Wolf666
                                        last edited by

                                        @Derelict:

                                        I had no idea This was 2.2.  Sorry.  Can't help with that.  there's a 2.2 feedback and problems thread for 2.2 feedback.  I don't know if it's a problem or if there's something misconfigured but I'm staying away from 2.2  no time.

                                        Thank you for your time.

                                        Modem Draytek Vigor 130
                                        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                        Switch Cisco SG350-10
                                        AP Netgear R7000 (Stock FW)
                                        HTPC Intel NUC5i3RYH
                                        NAS Synology DS1515+
                                        NAS Synology DS213+

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          If you refer to the document in https://forum.pfsense.org/index.php?topic=82944.msg454035#msg454035 I created a connection to VPNBOOK on pfSense A and successfully made Host B1 egress to the internet via OpenVPN to pfSense A then out the VPNBOOK connection.  Everything "just worked" as expected.

                                          Unfortunately, I can't build your specific config because I don't have a VPN provider that will give me a port forward.  I have asked airvpn for a trial account.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            Wolf666
                                            last edited by

                                            Should be a simple problem:

                                            Once I have the remote AirVPN Server NAT ready, I have a real AIRVPN_Public_IP, any hit to AIRVPN_Public_IP:port is NAT'd to the internal AIRVPN_IP:port that traffic should go straight inside the tunnel toward the end point of my pfSense AIRVPN_WAN IP (same as AIRVPN_IP:port).

                                            Said that my only action in pfSense should be a simple NAT to MyClient_IP:port and let pfSense make the automatic Firewall rule.

                                            Modem Draytek Vigor 130
                                            pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                            Switch Cisco SG350-10
                                            AP Netgear R7000 (Stock FW)
                                            HTPC Intel NUC5i3RYH
                                            NAS Synology DS1515+
                                            NAS Synology DS213+

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.