Port 22 doesn't forward

[mivion]

Hi,

pfSense 2.2.1-RELEASE (amd64).

I have two WANs + LAN.
WebConfigurator on port 9999
ssh on port 222.

I want to forward port 22 from WAN to ip address from LAN, but this doesn't work.
See attachment for NAT port forward rules.
Firewall rules for all interfaces are to pass all traffic.

But if I forward any other port, like 2244 then all is fine.

Why i cant forward port 22?

Sockstat output:

[2.2.1-RELEASE][root@border]/root: sockstat
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     sleep      51736 15 stream /var/run/php-fpm.socket
root     sshd       34430 5  tcp4   x.x.134.165:2222    x.x.197.249:50163
root     php-fpm    25583 0  stream /var/run/php-fpm.socket
root     php-fpm    25583 10 dgram  (not connected)
root     php-fpm    25583 11 udp4   *:*                   *:*
root     php-fpm    25583 12 udp6   *:*                   *:*
root     sh         17906 15 stream /var/run/php-fpm.socket
dhcpd    dhcpd      15953 9  dgram  -> /var/dhcpd/var/run/log
dhcpd    dhcpd      15953 13 udp4   *:67                  *:*
dhcpd    dhcpd      15953 15 stream /var/run/php-fpm.socket
dhcpd    dhcpd      15953 20 udp4   *:15216               *:*
dhcpd    dhcpd      15953 21 udp6   *:49484               *:*
unbound  unbound    12228 10 udp4   *:53                  *:*
unbound  unbound    12228 11 tcp4   *:53                  *:*
unbound  unbound    12228 12 udp6   *:53                  *:*
unbound  unbound    12228 13 tcp6   *:53                  *:*
unbound  unbound    12228 14 tcp4   127.0.0.1:953         *:*
unbound  unbound    12228 15 stream /var/run/php-fpm.socket
unbound  unbound    12228 16 dgram  -> /var/run/logpriv
unbound  unbound    12228 17 stream -> ??
unbound  unbound    12228 18 stream -> ??
unbound  unbound    12228 19 stream -> ??
unbound  unbound    12228 20 stream -> ??
root     lighttpd   38361 11 tcp4   *:9999                *:*
root     lighttpd   38361 12 tcp6   *:9999                *:*
root     lighttpd   38361 13 tcp4   *:80                  *:*
root     lighttpd   38361 14 tcp6   *:80                  *:*
root     lighttpd   38361 15 stream /var/run/php-fpm.socket
root     lighttpd   38361 17 dgram  -> /var/run/logpriv
root     sshd       36821 4  tcp6   *:2222                *:*
root     sshd       36821 5  tcp4   *:2222                *:*
root     ntpd       60877 3  dgram  -> /var/run/logpriv
root     ntpd       60877 20 udp6   *:123                 *:*
root     ntpd       60877 21 udp4   *:123                 *:*
root     ntpd       60877 22 udp6   fe80:1::b0b3:97ff:feee:6e5c:123 *:*
root     ntpd       60877 23 udp4   x.x.185.139:123   *:*
root     ntpd       60877 24 udp6   fe80:2::4c5a:f4ff:fe35:29b6:123 *:*
root     ntpd       60877 25 udp4   x.x.134.165:123     *:*
root     ntpd       60877 26 udp6   fe80:3::4aa:7aff:fe26:4fae:123 *:*
root     ntpd       60877 27 udp4   172.16.0.1:123        *:*
root     ntpd       60877 28 udp4   127.0.0.1:123         *:*
root     ntpd       60877 29 udp6   ::1:123               *:*
root     ntpd       60877 30 udp6   fe80:6::1:123         *:*
root     sshlockout 56534 3  dgram  -> /var/run/logpriv
root     login      56273 3  dgram  -> /var/run/logpriv
root     cron       48301 5  dgram  -> /var/run/logpriv
root     syslogd    48239 10 dgram  /var/run/log
root     syslogd    48239 11 dgram  /var/run/logpriv
root     syslogd    48239 12 dgram  /var/dhcpd/var/run/log
root     syslogd    48239 13 udp6   *:514                 *:*
root     syslogd    48239 14 udp4   *:514                 *:*
root     apinger    12292 1  dgram  -> /var/run/logpriv
root     sshlockout 11757 3  dgram  (not connected)
root     inetd      9257  11 udp4   127.0.0.1:6969        *:*
root     filterlog  8875  9  dgram  -> /var/run/logpriv
root     devd       269   10 stream /var/run/devd.pipe
root     check_relo 257   3  stream /var/run/check_reload_status
root     check_relo 257   6  dgram  -> /var/run/logpriv
root     php-fpm    241   10 dgram  (not connected)
root     php-fpm    241   11 udp4   *:*                   *:*
root     php-fpm    241   12 udp6   *:*                   *:*
root     php-fpm    241   15 stream -> ??
root     php-fpm    241   17 stream -> ??
root     php-fpm    241   18 stream /var/run/php-fpm.socket
?        ?          ?     ?  tcp4   x.x.134.165:9999    x.x.197.249:50102

Looks like there are no one locks 22 port. But why this doesn't work?

[johnpoz]

maybe its blocked by isp, maybe firewall on 172.16.1.3 blocks it?

Why don't you just sniff on the wan and validate that your seeing the traffic..  Why do you have udp forward, since when was ssh udp??

If you see on wan, then on lan sniff is it being sent to 172.16.1.3??

Have you looked over and followed?
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

So you have dual wan, how do you have return setup.. What determines that traffic from wan1 goes back out wan1?  Normally you wouldn't forward from both wans to same host, etc.  I would validate with wan1 first, make sure that works and if wan 1 is your default outbound?  Then once you have one working you can work on second wan inbound forward.

[mivion]

@johnpoz:

maybe its blocked by isp, maybe firewall on 172.16.1.3 blocks it?

No, a have tried this by setting SSH access for pfSense by port 22.

Why don't you just sniff on the wan and validate that your seeing the traffic..  Why do you have udp forward, since when was ssh udp??

I tried it by tcpdump, but there are no packets on wan to 22 port… :(
But a can access to other servers by this port. Hmm...
Will search in this direction, thanks.

About udp, thanks, it's my mistake.

[johnpoz]

"No, a have tried this by setting SSH access for pfSense by port 22."

Huh? So you access the server from pfsense via ssh, that would be from same segment.

If you are checking tcpdump and no traffic to 22, how could it ever forward to machine behind it..

[mivion]

Sorry, it was my mistake, i had access from another network :(

Now I wrote to my ISP to check blocked ports.

[johnpoz]

sure your actually hitting your public ip from outside?  Possible if your using a fqdn vs IP that you have the wrong one..  If your behind a NAT did you forward it there.  Do you have public IP or rfc1918 address on pfsense wan?

[mivion]

The problem in ISP, thank you for suggestion.