NAT Connection refused
-
Common Problems
1. NAT and firewall rules not correctly added (see How can I forward ports with pfSense?)
Hint: Do NOT set a source port
2. Firewall enabled on client machine
3. Client machine is not using pfSense as its default gateway
4. Client machine not actually listening on the port being forwarded
5. ISP or something upstream of pfSense is blocking the port being forwarded
6. Trying to test from inside the local network, need to test from an outside machine
7. Incorrect or missing Virtual IP configuration for additional public IP addresses
8. The pfSense router is not the border router. If there is something else between pfSense and the ISP, the port forwards and associated rules must be replicated there.
9. Forwarding ports to a server behind a Captive Portal. An IP bypass must be added both to and from the server's IP in order for a port forward to work behind a Captive Portal.
10. If this is on a WAN that is not the default gateway, make sure there is a gateway chosen on this WAN interface, or the firewall rules for the port forward would not reply back via the correct gateway.
11. If this is on a WAN that is not the default gateway, ensure the traffic for the port forward is NOT passed in via Floating Rules or an Interface Group. Only rules present on the WAN's interface tab under Firewall Rules will have the reply-to keyword to ensure the traffic responds properly via the expected gateway.
12. If this is on a WAN that is not the default gateway, make sure the firewall rule(s) allowing the traffic in do not have the box checked to disable reply-to.
13. If this is on a WAN that is not the default gateway, make sure the master reply-to disable switch is not checked under System > Advanced, on the Firewall/NAT tab.
14. WAN rules should NOT have a gateway set, so make sure that the rules for the port forward do NOT have a gateway configured on the actual rule.
15. If the traffic appears to be forwarding in to an unexpected device, it may be happening due to UPnP. Check Status > UPnP to see if an internal service has configured a port forward unexpectedly. If so, disable UPnP on either that device or on the firewall.
-
Thanks for the reply.
I am testing from outside - from inside everything works. Source port is not set.
Everything works fine with my old firewall/router - with NAT setup for same machines/ports
The only thing I am not familiar with is: 7. Incorrect or missing Virtual IP configuration for additional public IP addresses - I do not have any Virtual IP config settings -
It is on the WAN that IS the default gateway, not using captive portal.
-
That packet trace you sent says otherwise:
Internet Protocol Version 4, Src: 192.168.2.87 (192.168.2.87), Dst: 50.X.X.57 (50.X.X.57)
-
No it doesn't that is the LAN IP on a remote network. Again - I can swap in my old firewall/router (verizon tek) and everything works. And behind the PF sense firewall I can access everything. Server is listening on intended ports.
Also - if it was the servers - the PF Sense firewall would have log entries allowing the traffic through - I am not getting any entries in the log for any incoming traffic to the intended servers on their intended ports
Since I am not getting any log entries I am stumped. I have logging enabled on the firewall rules for the port forwarding traffic.
-
Oh, LAN IP on remote network…. ROFL.
Dude, draw a fucking network diagram with NO BULLSHIT there. I mean, the REAL one.
You've wasted hours of time of multiple people with this crap. It takes about a minute to set up and works out of the box. Post the real thing if you want help. Otherwise, GTFO!
:( >:( >:(
-
WTF is wrong with you - I have posted all the real thing. No shit it just works. Not my first rodeo chief.
This isn't working. its my first PF install.
There is not fucking diagram to draw.
External Port forward to same Internal Port -traffic getting dropped on firewall. No fucking magic.
What other screen shots do I have to post for you to offer some suggestions outside of snide remarks.
-
I want the REAL thing. No "multiple public IPs on LAN" bullshit and similar crap when you have 192.168.x.x stuff on LAN. Just the REAL thing. Yeah, it isn't working. Because you are asking for help and instead of relevant info, you are posting utterly misleading shit over and over again.
-
So you're testing from private networks outside of WAN? How are we supposed to know that? Did you uncheck "Block private networks" on the WAN interface? Uncheck block bogons while you're in there.
-
yes tried that and rebooted just to make sure changes were applied - does not work.
-
You keep saying when you put the other firewall in place it works. pfSense and that firewall have the same inside IP address right? And the default gateway of your server is pointed at that ONE address right?
Post CURRENT screen shots of:
Firewall > NAT, Port Forward tab
Firewall > NAT, 1:1 tab
Firewall > Rules, WAN tab
Don't make any changes, just post them.
