Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwarding help needed from Wolf666

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    34 Posts 4 Posters 6.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      Wolf666
      last edited by

      @Derelict:

      AIRVPN just sent a 3-day coupon to me.  I don't want to start the clock until I know you still need help with this.  Do you?

      Hi Derelict,

      yes I am still not able to make it work, I have started also packet capture and reading output in wireshark.

      Again, I confirm you that port forwarding on clear net side (WAN) is working pretty well.

      Modem Draytek Vigor 130
      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
      Switch Cisco SG350-10
      AP Netgear R7000 (Stock FW)
      HTPC Intel NUC5i3RYH
      NAS Synology DS1515+
      NAS Synology DS213+

      1 Reply Last reply Reply Quote 0
      • K
        kejianshi
        last edited by

        "My VPN provider (AIRVPN) offers port forwarding (also a DDNS service), basically offering their public ip and port to redirecting traffic to AIRVPN servers internal address and then go via tunnel to my clients."

        so  - 1 public IP at the VPN service provider and many potential clients to possibly NAT that 1 port to?

        So what if in the highly unlikely (very likely) event that 10 customers all want port 25?  or 80?  or 443?

        Then what?

        1 Reply Last reply Reply Quote 0
        • W
          Wolf666
          last edited by

          Each customer of AirVPN has 20 port assigned on random basis, it is impossible that 2 customers share the same port.

          Ref.: https://airvpn.org/faq/port_forwarding/

          BTW that solution has been working for 1 year with my WNDR37000 (openWRT) and R7000 (DD-WRT).

          Now, I think my setup in pfSense is conflicting with the bug still open in 2.2Beta, I am using 2 subnets, one dedicated to VPN only, with its dedicated Gateway.

          Modem Draytek Vigor 130
          pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
          Switch Cisco SG350-10
          AP Netgear R7000 (Stock FW)
          HTPC Intel NUC5i3RYH
          NAS Synology DS1515+
          NAS Synology DS213+

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            That would do it.  I was just wondering if there would be some sort of first come first served policy for the ports.

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi
              last edited by

              Are you using manual outbound NAT?

              1 Reply Last reply Reply Quote 0
              • W
                Wolf666
                last edited by

                @kejianshi:

                Are you using manual outbound NAT?

                Yes.
                2 rule:
                1 to route LAN to WAN
                2 to route VPN (OPT1) to AIRVPN_WAN

                I have also firewall rules consistent with my setup. Everything is working pretty fine, also port forwarding from WAN (clear internet) is working.

                Modem Draytek Vigor 130
                pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                Switch Cisco SG350-10
                AP Netgear R7000 (Stock FW)
                HTPC Intel NUC5i3RYH
                NAS Synology DS1515+
                NAS Synology DS213+

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  Lets say just for instance that you have a specific machine on the LAN and you want ALL of its outbound traffic to go out over the VPN.

                  You could make that happen with manual outbound NAT.

                  So, as a for instance, if traffic that was forwarded from your VPN into pfsense and onto a server on you LAN and you want outbound traffic to exit on the same interface it came in on,  if manual outbound NAT for that machine IP was set to your AIRVPN_WAN instead of your WAN, all the traffic should go out over the VPN.  That rule should be at the top.

                  I've done this with pfsense before but not with 2.2 so seems like it should work, but not sure 100%

                  If you wish to try, backup your settings first so its easy to go back if you don't like the results.

                  1 Reply Last reply Reply Quote 0
                  • W
                    Wolf666
                    last edited by

                    @kejianshi:

                    Lets say just for instance that you have a specific machine on the LAN and you want ALL of its outbound traffic to go out over the VPN.

                    You could make that happen with manual outbound NAT.

                    So, as a for instance, if traffic that was forwarded from your VPN into pfsense and onto a server on you LAN and you want outbound traffic to exit on the same interface it came in on,  if manual outbound NAT for that machine IP was set to your AIRVPN_WAN instead of your WAN, all the traffic should go out over the VPN.  That rule should be at the top.

                    I've done this with pfsense before but not with 2.2 so seems like it should work, but not sure 100%

                    If you wish to try, backup your settings first so its easy to go back if you don't like the results.

                    I use manual outbound NAT and it is working, I know there is a bug in 2.2Beta related to routing with several Gateways.

                    Modem Draytek Vigor 130
                    pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                    Switch Cisco SG350-10
                    AP Netgear R7000 (Stock FW)
                    HTPC Intel NUC5i3RYH
                    NAS Synology DS1515+
                    NAS Synology DS213+

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi
                      last edited by

                      Thats quite a bug…

                      1 Reply Last reply Reply Quote 0
                      • W
                        Wolf666
                        last edited by

                        @kejianshi:

                        Thats quite a bug…

                        ref:

                        https://forum.pfsense.org/index.php?topic=80607.0

                        https://redmine.pfsense.org/issues/3760

                        Modem Draytek Vigor 130
                        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                        Switch Cisco SG350-10
                        AP Netgear R7000 (Stock FW)
                        HTPC Intel NUC5i3RYH
                        NAS Synology DS1515+
                        NAS Synology DS213+

                        1 Reply Last reply Reply Quote 0
                        • W
                          Wolf666
                          last edited by

                          Ok, problem fixed.

                          Port Forwarding is working, the problem was definitely that: https://redmine.pfsense.org/issues/3760.

                          PS
                          Please MOD you can put a big SOLVED in the title!

                          Modem Draytek Vigor 130
                          pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                          Switch Cisco SG350-10
                          AP Netgear R7000 (Stock FW)
                          HTPC Intel NUC5i3RYH
                          NAS Synology DS1515+
                          NAS Synology DS213+

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.