Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT Connection refused

    Scheduled Pinned Locked Moved NAT
    38 Posts 4 Posters 9.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      You gave us zero information in that post to help us let you know what you did wrong.  How about real IP addresses and ports - better yet screen shots?  Make up a WAN IP if you must.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • S
        scopa
        last edited by

        OK I spelled it out there is not much to it

        1 Rule allowing access to the WAN address
        1 Nat rule from public IP to LAN ip

        Clicked enable on Adv page for Pure NAT and redirects.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          What is that Source address doing in your NAT Rule?

          You had to click Advanced to even see the option and broke the rule.

          You probably want ANY.

          Firewall Rule: Source * Port * Destination 192.168.1.50 Port *

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • S
            scopa
            last edited by

            I only want access to this device from a specific external network

            I created an Alias for this network (wan IP block) and used that as the source.

            I am not ready to open this up to any. Do you think that is actually blocking me? I have the same rule setup for my firewall access (source specific) and it works fine.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Then Firewall Rule: Source source network or alias Port * Destination 192.168.1.50 Port *

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • S
                scopa
                last edited by

                yeah - thats what I have and its not working. What circumstances would not show anything in the logs? No blocking, packet capture does not show anything either.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                  Check all those things.  This really does "just work."

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    So your nat reflection is not working? Its not working from external.  I could see nat reflection not working if you have a source in your rule that would block your actual source for example.

                    Is the traffic showing up on your wan?  There is nothing in the logs about the traffic being blocked - sniff does it hit your wan and then go out your lan.  Maybe your lan client firewall is blocking it, etc..

                    Step through the doc linked too.. Its got pretty much everything you would need to find the problem.  Once you have gone through the doc - let us know where its failing..  and its always better to just post screen shots of your rules and your nats so we can see if there is something conflicting.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • S
                      scopa
                      last edited by

                      I attached screen shots of my config - maybe someone can point out what I am doing wrong.

                      I had the 1:1 NAT setup w/ FW rules to port 40809 for SSH

                      I then tried adding some port forwarding to test our email server as well as SSH - but it still does not work.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Don't set source ports.

                        Common Problems

                        1. NAT and firewall rules not correctly added (see How can I forward ports with pfSense?)

                        Hint: Do NOT set a source port

                        https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

                        https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                        There is a list of all the things to check there.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          The OP should better decide whether he wants to do 1:1 NAT or port forwards… having a mish-mash of both trying to do the same things does NOT help.

                          https://forum.pfsense.org/index.php?topic=94940.0

                          1 Reply Last reply Reply Quote 0
                          • S
                            scopa
                            last edited by

                            Since all servers behind firewall have a public static IP I will do 1:1 NAT

                            In that case I will remove the Port Forwarders

                            Now - when I setup the rules for the 1:1 Nat servers - I set up the rules on the WAN INT - is the destination address the WAN IP or Internal IP of intended server?

                            Thanks,

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              I already linked this on the other thread! https://doc.pfsense.org/index.php/1:1_NAT

                              Read it. NOW.

                              Also:
                              https://doc.pfsense.org/index.php/Can_I_use_1:1_NAT_on_my_WAN_IP
                              https://doc.pfsense.org/index.php/Do_NAT_port_forwards_override_1:1_NAT

                              @scopa:

                              Since all servers behind firewall have a public static IP I will do 1:1 NAT

                              Errr… 192.168.5.220 is NOT a public (routable IP). Neither is 192.168.1.50. Both of those are RFC1918... If you had public IPs on LAN, there'd be no point in doing any NAT. In general, by posting totally misleading and confusing information, you are just wasting everyone's time, not to mention that it prevents people from providing relevant advise.

                              :(

                              1 Reply Last reply Reply Quote 0
                              • S
                                scopa
                                last edited by

                                ok.ok… so should be mapped to internal port

                                But reading this:

                                Yes, 1:1 NAT may be used from the WAN IP address to an internal IP address. But be aware that this maps every port and services on the firewall will no longer be reachable from the outside. To reach the firewall from the outside, port forward entries must be added to negate the 1:1 NAT for the specific ports on the firewall to be reached.

                                So dont' use 1:1 NAT for my purpose and use the port forwarding only?

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by

                                  What??? You just told us that "all servers behind firewall have a public static IP".

                                  Look, as already hinted in my previous post, I have absolutely no clue about your setup. Post some real information.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    scopa
                                    last edited by

                                    Here are my settings:

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      doktornotor Banned
                                      last edited by

                                      • What's "WAN_email"? Is that the same thing like the "External IP" in 1:1 NAT or not?
                                      • What's "LAN_email"? It that the same thing like "Internal IP" in the 1:1 NAT or not?
                                      • What's TCP 40809? Why's it both in antilockout and port forward?!
                                      • Where have all those other "servers with static public IP" vanished?!

                                      Looking at the setup and the generic mess, I have some extremely strange feeling I have seen this somewhere. Was about ~10 pages thread full of beep!

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        scopa
                                        last edited by

                                        WAN_email is public email ip alias
                                        LAN_email same thing

                                        40809 is custom ssh port

                                        Where have all those other "servers with static public IP" vanished

                                        -just trying to get my mail server working right now - once working should be easy to get the others online

                                        Thanks,

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          doktornotor Banned
                                          last edited by

                                          @scopa:

                                          WAN_email is public email ip alias
                                          LAN_email same thing

                                          That was not my question.

                                          @scopa:

                                          40809 is custom ssh port

                                          And why's it used both on pfSense and forwarded somewhere else ("email" server)?!

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            scopa
                                            last edited by

                                            • What's "WAN_email"? Is that the same thing like the "External IP" in 1:1 NAT or not?
                                            • yes

                                            What's "LAN_email"? It that the same thing like "Internal IP" in the 1:1 NAT or not?

                                            • yes

                                            I use a custom ssh port for the firewall as well. That was auto generated when I modified the default port

                                            Thanks again for your help

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.