NAT Connection refused
-
Since all servers behind firewall have a public static IP I will do 1:1 NAT
In that case I will remove the Port Forwarders
Now - when I setup the rules for the 1:1 Nat servers - I set up the rules on the WAN INT - is the destination address the WAN IP or Internal IP of intended server?
Thanks,
-
I already linked this on the other thread! https://doc.pfsense.org/index.php/1:1_NAT
Read it. NOW.
Also:
https://doc.pfsense.org/index.php/Can_I_use_1:1_NAT_on_my_WAN_IP
https://doc.pfsense.org/index.php/Do_NAT_port_forwards_override_1:1_NATSince all servers behind firewall have a public static IP I will do 1:1 NAT
Errr… 192.168.5.220 is NOT a public (routable IP). Neither is 192.168.1.50. Both of those are RFC1918... If you had public IPs on LAN, there'd be no point in doing any NAT. In general, by posting totally misleading and confusing information, you are just wasting everyone's time, not to mention that it prevents people from providing relevant advise.
:(
-
ok.ok… so should be mapped to internal port
But reading this:
Yes, 1:1 NAT may be used from the WAN IP address to an internal IP address. But be aware that this maps every port and services on the firewall will no longer be reachable from the outside. To reach the firewall from the outside, port forward entries must be added to negate the 1:1 NAT for the specific ports on the firewall to be reached.
So dont' use 1:1 NAT for my purpose and use the port forwarding only?
-
What??? You just told us that "all servers behind firewall have a public static IP".
Look, as already hinted in my previous post, I have absolutely no clue about your setup. Post some real information.
-
Here are my settings:
-
- What's "WAN_email"? Is that the same thing like the "External IP" in 1:1 NAT or not?
- What's "LAN_email"? It that the same thing like "Internal IP" in the 1:1 NAT or not?
- What's TCP 40809? Why's it both in antilockout and port forward?!
- Where have all those other "servers with static public IP" vanished?!
Looking at the setup and the generic mess, I have some extremely strange feeling I have seen this somewhere. Was about ~10 pages thread full of beep!
-
WAN_email is public email ip alias
LAN_email same thing40809 is custom ssh port
Where have all those other "servers with static public IP" vanished
-just trying to get my mail server working right now - once working should be easy to get the others online
Thanks,
-
-
- What's "WAN_email"? Is that the same thing like the "External IP" in 1:1 NAT or not?
- yes
What's "LAN_email"? It that the same thing like "Internal IP" in the 1:1 NAT or not?
- yes
I use a custom ssh port for the firewall as well. That was auto generated when I modified the default port
Thanks again for your help
-
- What's "WAN_email"? Is that the same thing like the "External IP" in 1:1 NAT or not?
- yes
What's "LAN_email"? It that the same thing like "Internal IP" in the 1:1 NAT or not?
- yes
Then - as already noted multiple times - either use 1:1 NAT, or port forwards. NOT both!!!
I use a custom ssh port for the firewall as well. That was auto generated when I modified the default port
You won't be able to reach your pfSense SSH from WAN at all.
-
That is how I originally had it setup - but one of the links you sent say
Yes, 1:1 NAT may be used from the WAN IP address to an internal IP address. But be aware that this maps every port and services on the firewall will no longer be reachable from the outside. To reach the firewall from the outside, port forward entries must be added to negate the 1:1 NAT for the specific ports on the firewall to be reached.
This says that you need to use both WTF?
Doesn't matter have tried it multiple ways by now - w/ Port Forwarding and NAT, NAT only, Port Forwarding only - nothing works
If I open up 40809 on wan to firewall why can't I reach my pfsense via SSH?
-
I give up. Get paid support.
-
Delete it all and start over again. You don't need 1:1 NAT. Add the port forwards - one at a time. Testing all the way to be sure it's doing what you want. Stop and ask for help at the point you hit a block, not after you've over-complicated it again.
You are all over the place with this. Take a step back and add one thing at a time.
This all just works.
And, again:
https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting -
So you posted your public IP that 50.x.x.157 IP Is that your only IP or do you have more than 1?
I would get your port forwarding with 1 IP working - follow the instructions provided by Derelict.. This really is click click done.. First thing I would do is enable icmp to your wan IP. We can then validate that we can ping your IP.. You can then validate that traffic is atleast getting to your wan with a sniff, etc.
You do not need or normally want 1:1 nat.. You only have a few ports you need open, this should be click done all of 10 seconds to setup.
Once you have cleared up this mess you have. Please enable icmp to your wan. And we can validate we can atleast ping you..
So right now I am pinging that 50.x.x.157 address
root@ns1:~# ping 50.xx.xx.157
PING 50.xx.xx.157 (50.xx.xx.157) 56(84) bytes of data.
64 bytes from 50.xx.xx.157: icmp_seq=1 ttl=49 time=93.2 ms
64 bytes from 50.xx.xx.157: icmp_seq=2 ttl=49 time=91.2 ms
64 bytes from 50.xx.xx.157: icmp_seq=3 ttl=49 time=93.1 msBut can not get to 25 on that ip
-
I deleted all the NAT rules and Firewall Rules
Created port forwarding rule - to port 40809 and anotther for port 25
SSH works behind the firewall and port 25 is listening on the server
Since all incoming connections are "connection refused"
What else can be causing this to be dropped. Should I disable the NAT settings in System -> Advanced? (attached)
Thanks for your help
-
I attached a small capture but the firewall is dropping this connection. There has to be someplace on here that is not allowing it through
-
Common Problems
1. NAT and firewall rules not correctly added (see How can I forward ports with pfSense?)
Hint: Do NOT set a source port
2. Firewall enabled on client machine
3. Client machine is not using pfSense as its default gateway
4. Client machine not actually listening on the port being forwarded
5. ISP or something upstream of pfSense is blocking the port being forwarded
6. Trying to test from inside the local network, need to test from an outside machine
7. Incorrect or missing Virtual IP configuration for additional public IP addresses
8. The pfSense router is not the border router. If there is something else between pfSense and the ISP, the port forwards and associated rules must be replicated there.
9. Forwarding ports to a server behind a Captive Portal. An IP bypass must be added both to and from the server's IP in order for a port forward to work behind a Captive Portal.
10. If this is on a WAN that is not the default gateway, make sure there is a gateway chosen on this WAN interface, or the firewall rules for the port forward would not reply back via the correct gateway.
11. If this is on a WAN that is not the default gateway, ensure the traffic for the port forward is NOT passed in via Floating Rules or an Interface Group. Only rules present on the WAN's interface tab under Firewall Rules will have the reply-to keyword to ensure the traffic responds properly via the expected gateway.
12. If this is on a WAN that is not the default gateway, make sure the firewall rule(s) allowing the traffic in do not have the box checked to disable reply-to.
13. If this is on a WAN that is not the default gateway, make sure the master reply-to disable switch is not checked under System > Advanced, on the Firewall/NAT tab.
14. WAN rules should NOT have a gateway set, so make sure that the rules for the port forward do NOT have a gateway configured on the actual rule.
15. If the traffic appears to be forwarding in to an unexpected device, it may be happening due to UPnP. Check Status > UPnP to see if an internal service has configured a port forward unexpectedly. If so, disable UPnP on either that device or on the firewall.
-
Thanks for the reply.
I am testing from outside - from inside everything works. Source port is not set.
Everything works fine with my old firewall/router - with NAT setup for same machines/ports
The only thing I am not familiar with is: 7. Incorrect or missing Virtual IP configuration for additional public IP addresses - I do not have any Virtual IP config settings -
It is on the WAN that IS the default gateway, not using captive portal.
-
That packet trace you sent says otherwise:
Internet Protocol Version 4, Src: 192.168.2.87 (192.168.2.87), Dst: 50.X.X.57 (50.X.X.57)
-
No it doesn't that is the LAN IP on a remote network. Again - I can swap in my old firewall/router (verizon tek) and everything works. And behind the PF sense firewall I can access everything. Server is listening on intended ports.
Also - if it was the servers - the PF Sense firewall would have log entries allowing the traffic through - I am not getting any entries in the log for any incoming traffic to the intended servers on their intended ports
Since I am not getting any log entries I am stumped. I have logging enabled on the firewall rules for the port forwarding traffic.
