Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwarding help needed from Wolf666

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    34 Posts 4 Posters 6.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      Wolf666
      last edited by

      Port Forward

      AIRVPN_WAN TCP * * AIRVPN_WAN address 9091 192.168.2.10 9091

      Firewall (AIRVPN_WAN Tab):

      IPv4 TCP * * 192.168.2.10 9091 AIRVPN_WAN none

      Firewall (OpenVPN Tab):

      No rules are currently defined for this interface
      All incoming connections on this interface will be blocked until you add pass rules.

      For info the port forwarding:
      WAN TCP * * WAN address 21000 192.168.1.6 11678

      With firewall rule on WAN tab:
      IPv4 TCP * * 192.168.1.6 11678 * none

      Works.

      The default gateway is WAN (*)

      Modem Draytek Vigor 130
      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
      Switch Cisco SG350-10
      AP Netgear R7000 (Stock FW)
      HTPC Intel NUC5i3RYH
      NAS Synology DS1515+
      NAS Synology DS213+

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Firewall (AIRVPN_WAN Tab):

        IPv4 TCP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

        Try getting rid of that gateway and setting the rule to default.  That's wrong.  That says that traffic received by pfSense in interface AIRVPN_WAN (from AIRVPN) should use AIRVPN_WAN as the gateway.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • W
          Wolf666
          last edited by

          @Derelict:

          Firewall (AIRVPN_WAN Tab):

          IPv4 TCP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

          Try getting rid of that gateway and setting the rule to default.  That's wrong.  That says that traffic received by pfSense in interface AIRVPN_WAN (from AIRVPN) should use AIRVPN_WAN as the gateway.

          OK modification done

          IPv4 TCP/UDP * * 192.168.2.10 9091 * none

          Looking at Firewall log:

          PASS - Oct 16 20:49:08 AIRVPN_WAN USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454           192.168.2.10:9091 TCP:S

          PASS - Oct 16 20:48:55 AIRVPN_WAN USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755           192.168.2.10:9091 UDP

          BLOCK - Oct 16 20:50:41 VPN Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454 TCP:SA

          BLOCK - Oct 16 20:49:53 Direction=OUT WAN Default deny rule IPv4 (1000000102)  192.168.2.10:9091     95.211.138.143:36454 TCP:SA

          So the Port forwarding rule is correctly applied but the acknowledgement is blocked.

          TCP:SA is blocked because of the following:

          Outbound NAT

          PASS AIRVPN_WAN 192.168.2.0/24 * * * AIRVPN_WAN address *

          Firewall Rule (VPN Tab)

          BLOCK IPv4 TCP/UDP * * ! 10.4.0.1 53 (DNS) AIRVPN_WAN_GW none
          PASS IPv4 TCP/UDP VPN net * * * AIRVPN_WAN_GW none

          Basically I created my Home Lan in order to allow clients connected to VPN interface to go through AIRVPN Tunnel always, using AIRVPN DNS only.

          I thought TCP:SA was routed via established tunnel as well, automatically.

          Modem Draytek Vigor 130
          pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
          Switch Cisco SG350-10
          AP Netgear R7000 (Stock FW)
          HTPC Intel NUC5i3RYH
          NAS Synology DS1515+
          NAS Synology DS213+

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            The times on that log snippet don't make a lot of sense.

            PASS - Oct 16 20:49:08  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454            192.168.2.10:9091  TCP:S

            PASS - Oct 16 20:48:55  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755            192.168.2.10:9091  UDP

            BLOCK - Oct 16 20:50:41  VPN  Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454  TCP:SA

            BLOCK - Oct 16 20:49:53  Direction=OUT WAN  Default deny rule IPv4 (1000000102)  192.168.2.10:9091      95.211.138.143:36454  TCP:SA

            There's like minutes between the S and SA in that log snippet.

            If you look at Diagnostics->States and filter on 192.168.2.10 or maybe 9091, what states are there when the VPN client is trying to connect inbound on 9091?

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • W
              Wolf666
              last edited by

              Here the states:

              AIRVPN_WAN udp 192.168.2.10:9091 (10.4.102.214:9091) <- 95.211.138.143:47494 NO_TRAFFIC:SINGLE

              VPN udp 95.211.138.143:47494 -> 192.168.2.10:9091 SINGLE:NO_TRAFFIC

              Modem Draytek Vigor 130
              pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
              Switch Cisco SG350-10
              AP Netgear R7000 (Stock FW)
              HTPC Intel NUC5i3RYH
              NAS Synology DS1515+
              NAS Synology DS213+

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                I'm confused now.  Is this TCP or UDP traffic you're trying to forward.  When you tried it that time were there any firewall log hits?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • W
                  Wolf666
                  last edited by

                  @Derelict:

                  I'm confused now.  Is this TCP or UDP traffic you're trying to forward.  When you tried it that time were there any firewall log hits?

                  Sorry it was midnight in Italy …. and I made some confusion. My goal is to forward both TCP/UDP as suggested by AirVPN. I did that in the past with iptables.

                  Back to the problem

                  Settings:

                  PF

                  AIRVPN_WAN  TCP/UDP  *  *  AIRVPN_WAN address  9091  192.168.2.10  9091

                  Firewall (AIRVPN_WAN Tab):

                  IPv4 TCP/UDP  *  *  192.168.2.10  9091  AIRVPN_WAN  none

                  Firewall LOG

                  PASS - Oct 16 20:49:08  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:36454            192.168.2.10:9091  TCP:S

                  PASS - Oct 16 20:48:55  AIRVPN_WAN  USER_RULE NAT Test Trasm (1413477300) 95.211.138.143:50755            192.168.2.10:9091  UDP

                  BLOCK - Oct 16 20:50:41  VPN  Default deny rule IPv4 (1000000101)                          192.168.2.10:9091          95.211.138.143:36454  TCP:SA

                  BLOCK - Oct 16 20:49:53  Direction=OUT WAN  Default deny rule IPv4 (1000000102)  192.168.2.10:9091      95.211.138.143:36454  TCP:SA

                  State

                  AIRVPN_WAN  udp  192.168.2.10:9091 (10.4.102.214:9091) <- 95.211.138.143:47494  NO_TRAFFIC:SINGLE

                  VPN  udp  95.211.138.143:47494 -> 192.168.2.10:9091  SINGLE:NO_TRAFFIC

                  Modem Draytek Vigor 130
                  pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                  Switch Cisco SG350-10
                  AP Netgear R7000 (Stock FW)
                  HTPC Intel NUC5i3RYH
                  NAS Synology DS1515+
                  NAS Synology DS213+

                  1 Reply Last reply Reply Quote 0
                  • W
                    Wolf666
                    last edited by

                    Can be releted to that bug: https://redmine.pfsense.org/issues/3760 ?

                    I am using 2.2Beta (16OCT)

                    Modem Draytek Vigor 130
                    pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                    Switch Cisco SG350-10
                    AP Netgear R7000 (Stock FW)
                    HTPC Intel NUC5i3RYH
                    NAS Synology DS1515+
                    NAS Synology DS213+

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      I had no idea This was 2.2.  Sorry.  Can't help with that.  there's a 2.2 feedback and problems thread for 2.2 feedback.  I don't know if it's a problem or if there's something misconfigured but I'm staying away from 2.2  no time.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • W
                        Wolf666
                        last edited by

                        @Derelict:

                        I had no idea This was 2.2.  Sorry.  Can't help with that.  there's a 2.2 feedback and problems thread for 2.2 feedback.  I don't know if it's a problem or if there's something misconfigured but I'm staying away from 2.2  no time.

                        Thank you for your time.

                        Modem Draytek Vigor 130
                        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                        Switch Cisco SG350-10
                        AP Netgear R7000 (Stock FW)
                        HTPC Intel NUC5i3RYH
                        NAS Synology DS1515+
                        NAS Synology DS213+

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          If you refer to the document in https://forum.pfsense.org/index.php?topic=82944.msg454035#msg454035 I created a connection to VPNBOOK on pfSense A and successfully made Host B1 egress to the internet via OpenVPN to pfSense A then out the VPNBOOK connection.  Everything "just worked" as expected.

                          Unfortunately, I can't build your specific config because I don't have a VPN provider that will give me a port forward.  I have asked airvpn for a trial account.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • W
                            Wolf666
                            last edited by

                            Should be a simple problem:

                            Once I have the remote AirVPN Server NAT ready, I have a real AIRVPN_Public_IP, any hit to AIRVPN_Public_IP:port is NAT'd to the internal AIRVPN_IP:port that traffic should go straight inside the tunnel toward the end point of my pfSense AIRVPN_WAN IP (same as AIRVPN_IP:port).

                            Said that my only action in pfSense should be a simple NAT to MyClient_IP:port and let pfSense make the automatic Firewall rule.

                            Modem Draytek Vigor 130
                            pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                            Switch Cisco SG350-10
                            AP Netgear R7000 (Stock FW)
                            HTPC Intel NUC5i3RYH
                            NAS Synology DS1515+
                            NAS Synology DS213+

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              You're right.  It shound be that simple.  If AIRVPN gives me an account and I can mock it up here, then maybe you can file a bug report if you do the same thing and it doesn't work in 2.2.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                AIRVPN just sent a 3-day coupon to me.  I don't want to start the clock until I know you still need help with this.  Do you?

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • W
                                  Wolf666
                                  last edited by

                                  @Derelict:

                                  AIRVPN just sent a 3-day coupon to me.  I don't want to start the clock until I know you still need help with this.  Do you?

                                  Hi Derelict,

                                  yes I am still not able to make it work, I have started also packet capture and reading output in wireshark.

                                  Again, I confirm you that port forwarding on clear net side (WAN) is working pretty well.

                                  Modem Draytek Vigor 130
                                  pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                  Switch Cisco SG350-10
                                  AP Netgear R7000 (Stock FW)
                                  HTPC Intel NUC5i3RYH
                                  NAS Synology DS1515+
                                  NAS Synology DS213+

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    kejianshi
                                    last edited by

                                    "My VPN provider (AIRVPN) offers port forwarding (also a DDNS service), basically offering their public ip and port to redirecting traffic to AIRVPN servers internal address and then go via tunnel to my clients."

                                    so  - 1 public IP at the VPN service provider and many potential clients to possibly NAT that 1 port to?

                                    So what if in the highly unlikely (very likely) event that 10 customers all want port 25?  or 80?  or 443?

                                    Then what?

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      Wolf666
                                      last edited by

                                      Each customer of AirVPN has 20 port assigned on random basis, it is impossible that 2 customers share the same port.

                                      Ref.: https://airvpn.org/faq/port_forwarding/

                                      BTW that solution has been working for 1 year with my WNDR37000 (openWRT) and R7000 (DD-WRT).

                                      Now, I think my setup in pfSense is conflicting with the bug still open in 2.2Beta, I am using 2 subnets, one dedicated to VPN only, with its dedicated Gateway.

                                      Modem Draytek Vigor 130
                                      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                      Switch Cisco SG350-10
                                      AP Netgear R7000 (Stock FW)
                                      HTPC Intel NUC5i3RYH
                                      NAS Synology DS1515+
                                      NAS Synology DS213+

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kejianshi
                                        last edited by

                                        That would do it.  I was just wondering if there would be some sort of first come first served policy for the ports.

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kejianshi
                                          last edited by

                                          Are you using manual outbound NAT?

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            Wolf666
                                            last edited by

                                            @kejianshi:

                                            Are you using manual outbound NAT?

                                            Yes.
                                            2 rule:
                                            1 to route LAN to WAN
                                            2 to route VPN (OPT1) to AIRVPN_WAN

                                            I have also firewall rules consistent with my setup. Everything is working pretty fine, also port forwarding from WAN (clear internet) is working.

                                            Modem Draytek Vigor 130
                                            pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                                            Switch Cisco SG350-10
                                            AP Netgear R7000 (Stock FW)
                                            HTPC Intel NUC5i3RYH
                                            NAS Synology DS1515+
                                            NAS Synology DS213+

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.