Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwarding help needed from Wolf666

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    34 Posts 4 Posters 6.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      Wolf666
      last edited by

      @Derelict:

      What are your rules on the AIRVPN_WAN interface?

      What are your rules on the OpenVPN Tab?

      Since I cancelled the Port forwardings rules, for both:

      "No rules are currently defined for this interface
      All incoming connections on this interface will be blocked until you add pass rules."

      Now I setup the port forwarding and I report back in minutes

      Modem Draytek Vigor 130
      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
      Switch Cisco SG350-10
      AP Netgear R7000 (Stock FW)
      HTPC Intel NUC5i3RYH
      NAS Synology DS1515+
      NAS Synology DS213+

      1 Reply Last reply Reply Quote 0
      • W
        Wolf666
        last edited by

        Port Forward

        AIRVPN_WAN TCP * * AIRVPN_WAN address 9091 192.168.2.10 9091

        Firewall (AIRVPN_WAN Tab):

        IPv4 TCP * * 192.168.2.10 9091 AIRVPN_WAN none

        Firewall (OpenVPN Tab):

        No rules are currently defined for this interface
        All incoming connections on this interface will be blocked until you add pass rules.

        For info the port forwarding:
        WAN TCP * * WAN address 21000 192.168.1.6 11678

        With firewall rule on WAN tab:
        IPv4 TCP * * 192.168.1.6 11678 * none

        Works.

        The default gateway is WAN (*)

        Modem Draytek Vigor 130
        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
        Switch Cisco SG350-10
        AP Netgear R7000 (Stock FW)
        HTPC Intel NUC5i3RYH
        NAS Synology DS1515+
        NAS Synology DS213+

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Firewall (AIRVPN_WAN Tab):

          IPv4 TCP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

          Try getting rid of that gateway and setting the rule to default.  That's wrong.  That says that traffic received by pfSense in interface AIRVPN_WAN (from AIRVPN) should use AIRVPN_WAN as the gateway.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • W
            Wolf666
            last edited by

            @Derelict:

            Firewall (AIRVPN_WAN Tab):

            IPv4 TCP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

            Try getting rid of that gateway and setting the rule to default.  That's wrong.  That says that traffic received by pfSense in interface AIRVPN_WAN (from AIRVPN) should use AIRVPN_WAN as the gateway.

            OK modification done

            IPv4 TCP/UDP * * 192.168.2.10 9091 * none

            Looking at Firewall log:

            PASS - Oct 16 20:49:08 AIRVPN_WAN USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454           192.168.2.10:9091 TCP:S

            PASS - Oct 16 20:48:55 AIRVPN_WAN USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755           192.168.2.10:9091 UDP

            BLOCK - Oct 16 20:50:41 VPN Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454 TCP:SA

            BLOCK - Oct 16 20:49:53 Direction=OUT WAN Default deny rule IPv4 (1000000102)  192.168.2.10:9091     95.211.138.143:36454 TCP:SA

            So the Port forwarding rule is correctly applied but the acknowledgement is blocked.

            TCP:SA is blocked because of the following:

            Outbound NAT

            PASS AIRVPN_WAN 192.168.2.0/24 * * * AIRVPN_WAN address *

            Firewall Rule (VPN Tab)

            BLOCK IPv4 TCP/UDP * * ! 10.4.0.1 53 (DNS) AIRVPN_WAN_GW none
            PASS IPv4 TCP/UDP VPN net * * * AIRVPN_WAN_GW none

            Basically I created my Home Lan in order to allow clients connected to VPN interface to go through AIRVPN Tunnel always, using AIRVPN DNS only.

            I thought TCP:SA was routed via established tunnel as well, automatically.

            Modem Draytek Vigor 130
            pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
            Switch Cisco SG350-10
            AP Netgear R7000 (Stock FW)
            HTPC Intel NUC5i3RYH
            NAS Synology DS1515+
            NAS Synology DS213+

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              The times on that log snippet don't make a lot of sense.

              PASS - Oct 16 20:49:08  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454            192.168.2.10:9091  TCP:S

              PASS - Oct 16 20:48:55  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755            192.168.2.10:9091  UDP

              BLOCK - Oct 16 20:50:41  VPN  Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454  TCP:SA

              BLOCK - Oct 16 20:49:53  Direction=OUT WAN  Default deny rule IPv4 (1000000102)  192.168.2.10:9091      95.211.138.143:36454  TCP:SA

              There's like minutes between the S and SA in that log snippet.

              If you look at Diagnostics->States and filter on 192.168.2.10 or maybe 9091, what states are there when the VPN client is trying to connect inbound on 9091?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • W
                Wolf666
                last edited by

                Here the states:

                AIRVPN_WAN udp 192.168.2.10:9091 (10.4.102.214:9091) <- 95.211.138.143:47494 NO_TRAFFIC:SINGLE

                VPN udp 95.211.138.143:47494 -> 192.168.2.10:9091 SINGLE:NO_TRAFFIC

                Modem Draytek Vigor 130
                pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                Switch Cisco SG350-10
                AP Netgear R7000 (Stock FW)
                HTPC Intel NUC5i3RYH
                NAS Synology DS1515+
                NAS Synology DS213+

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  I'm confused now.  Is this TCP or UDP traffic you're trying to forward.  When you tried it that time were there any firewall log hits?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • W
                    Wolf666
                    last edited by

                    @Derelict:

                    I'm confused now.  Is this TCP or UDP traffic you're trying to forward.  When you tried it that time were there any firewall log hits?

                    Sorry it was midnight in Italy …. and I made some confusion. My goal is to forward both TCP/UDP as suggested by AirVPN. I did that in the past with iptables.

                    Back to the problem

                    Settings:

                    PF

                    AIRVPN_WAN  TCP/UDP  *  *  AIRVPN_WAN address  9091  192.168.2.10  9091

                    Firewall (AIRVPN_WAN Tab):

                    IPv4 TCP/UDP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

                    Firewall LOG

                    PASS - Oct 16 20:49:08  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454            192.168.2.10:9091  TCP:S

                    PASS - Oct 16 20:48:55  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755            192.168.2.10:9091  UDP

                    BLOCK - Oct 16 20:50:41  VPN  Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454  TCP:SA

                    BLOCK - Oct 16 20:49:53  Direction=OUT WAN  Default deny rule IPv4 (1000000102)  192.168.2.10:9091      95.211.138.143:36454  TCP:SA

                    State

                    AIRVPN_WAN  udp  192.168.2.10:9091 (10.4.102.214:9091) <- 95.211.138.143:47494  NO_TRAFFIC:SINGLE

                    VPN  udp  95.211.138.143:47494 -> 192.168.2.10:9091  SINGLE:NO_TRAFFIC

                    Modem Draytek Vigor 130
                    pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                    Switch Cisco SG350-10
                    AP Netgear R7000 (Stock FW)
                    HTPC Intel NUC5i3RYH
                    NAS Synology DS1515+
                    NAS Synology DS213+

                    1 Reply Last reply Reply Quote 0
                    • W
                      Wolf666
                      last edited by

                      Can be releted to that bug: https://redmine.pfsense.org/issues/3760 ?

                      I am using 2.2Beta (16OCT)

                      Modem Draytek Vigor 130
                      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                      Switch Cisco SG350-10
                      AP Netgear R7000 (Stock FW)
                      HTPC Intel NUC5i3RYH
                      NAS Synology DS1515+
                      NAS Synology DS213+

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        I had no idea This was 2.2.  Sorry.  Can't help with that.  there's a 2.2 feedback and problems thread for 2.2 feedback.  I don't know if it's a problem or if there's something misconfigured but I'm staying away from 2.2  no time.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • W
                          Wolf666
                          last edited by

                          @Derelict:

                          I had no idea This was 2.2.  Sorry.  Can't help with that.  there's a 2.2 feedback and problems thread for 2.2 feedback.  I don't know if it's a problem or if there's something misconfigured but I'm staying away from 2.2  no time.

                          Thank you for your time.

                          Modem Draytek Vigor 130
                          pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                          Switch Cisco SG350-10
                          AP Netgear R7000 (Stock FW)
                          HTPC Intel NUC5i3RYH
                          NAS Synology DS1515+
                          NAS Synology DS213+

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            If you refer to the document in https://forum.pfsense.org/index.php?topic=82944.msg454035#msg454035 I created a connection to VPNBOOK on pfSense A and successfully made Host B1 egress to the internet via OpenVPN to pfSense A then out the VPNBOOK connection.  Everything "just worked" as expected.

                            Unfortunately, I can't build your specific config because I don't have a VPN provider that will give me a port forward.  I have asked airvpn for a trial account.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • W
                              Wolf666
                              last edited by

                              Should be a simple problem:

                              Once I have the remote AirVPN Server NAT ready, I have a real AIRVPN_Public_IP, any hit to AIRVPN_Public_IP:port is NAT'd to the internal AIRVPN_IP:port that traffic should go straight inside the tunnel toward the end point of my pfSense AIRVPN_WAN IP (same as AIRVPN_IP:port).

                              Said that my only action in pfSense should be a simple NAT to MyClient_IP:port and let pfSense make the automatic Firewall rule.

                              Modem Draytek Vigor 130
                              pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                              Switch Cisco SG350-10
                              AP Netgear R7000 (Stock FW)
                              HTPC Intel NUC5i3RYH
                              NAS Synology DS1515+
                              NAS Synology DS213+

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                You're right.  It shound be that simple.  If AIRVPN gives me an account and I can mock it up here, then maybe you can file a bug report if you do the same thing and it doesn't work in 2.2.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  AIRVPN just sent a 3-day coupon to me.  I don't want to start the clock until I know you still need help with this.  Do you?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    Wolf666
                                    last edited by

                                    @Derelict:

                                    AIRVPN just sent a 3-day coupon to me.  I don't want to start the clock until I know you still need help with this.  Do you?

                                    Hi Derelict,

                                    yes I am still not able to make it work, I have started also packet capture and reading output in wireshark.

                                    Again, I confirm you that port forwarding on clear net side (WAN) is working pretty well.

                                    Modem Draytek Vigor 130
                                    pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                    Switch Cisco SG350-10
                                    AP Netgear R7000 (Stock FW)
                                    HTPC Intel NUC5i3RYH
                                    NAS Synology DS1515+
                                    NAS Synology DS213+

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kejianshi
                                      last edited by

                                      "My VPN provider (AIRVPN) offers port forwarding (also a DDNS service), basically offering their public ip and port to redirecting traffic to AIRVPN servers internal address and then go via tunnel to my clients."

                                      so  - 1 public IP at the VPN service provider and many potential clients to possibly NAT that 1 port to?

                                      So what if in the highly unlikely (very likely) event that 10 customers all want port 25?  or 80?  or 443?

                                      Then what?

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        Wolf666
                                        last edited by

                                        Each customer of AirVPN has 20 port assigned on random basis, it is impossible that 2 customers share the same port.

                                        Ref.: https://airvpn.org/faq/port_forwarding/

                                        BTW that solution has been working for 1 year with my WNDR37000 (openWRT) and R7000 (DD-WRT).

                                        Now, I think my setup in pfSense is conflicting with the bug still open in 2.2Beta, I am using 2 subnets, one dedicated to VPN only, with its dedicated Gateway.

                                        Modem Draytek Vigor 130
                                        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                        Switch Cisco SG350-10
                                        AP Netgear R7000 (Stock FW)
                                        HTPC Intel NUC5i3RYH
                                        NAS Synology DS1515+
                                        NAS Synology DS213+

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kejianshi
                                          last edited by

                                          That would do it.  I was just wondering if there would be some sort of first come first served policy for the ports.

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            kejianshi
                                            last edited by

                                            Are you using manual outbound NAT?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.