Port forwarding issue
-
Hello
I've recently switched my network to pfsense to replace my aging router. The setup I'm using is that pfsense runs on my main server which has pfsense fully virtualized. I added 2 nic's an dedicated them to pfsense and the host system shouldn't be able to contact with those ports. These nics are respecitvely the wan and lan. My wan connects through a direct PPPOE session via the modem to my isp.
After lots of trouble figuring the previous out I am now bashing my head against port forwarding.
I've spend hours researching the issue and i'm getting very frustrated as somehow this ist working, with my previous router this was simply a walk in the park.
As far as I have seen I made the correct settings in pfsense, my isp doesn't block anything and the server works. Port scanners only deliver errors.
I've seen the troubleshooting guides here and they can't help.Please help me…
-
Are you testing this from WAN or LAN? WAN is the only true way to test it. LAN will give you reflection issues.
-
I am testing it through a seperate internet connection. As i've said my previous setup has worked for many years and i have the basic know-how around port forwarding, but at pfsense i've seem to've hit a wall.
-
you do understand ftp is 2 ports control and data.. And what are the clients trying to do to access your ftp active or passive..
Pfsense does not have a ftp helper/proxy any more.. So running a server behind pfsense requires the ports to be configured correctly if your server is going to run passive you would need to make sure it uses a range you can forward, and that it actually gives out your public IP vs its private IP its sitting on that the helper use to correct for you.
if uses are going to use active to talk to it then you need to make sure it can talk outbound on any port that the clients might be telling them to connect to from its source port 20.
Also your forward is WRONG, your dest would be your wan address not any.
-
@johnpoz, thanks for your reply.
In my old setup using DD-wrt forwarding port 21 was enough to let file zilla server work. Aside from FTP I had many other services running btw.
Unfortunately I've also tried setting the desitnation at wan but without succes, I've tried nearly all options on that page.
I'm thinking on rolling back to a previous version which I succesfully labo tested last year or reinstalling the current package.
Currently my pfsense crashes each day even without load … -
just wondering why your source port is FTP as well. Should be "Any" if I am not mistaken.
-
Good catch.. Yeah source should be ANY!! doubt ftp is coming from port 21 to 21
What are your client going to be using passive or active?? As stated pfsense has no helper/proxy for ftp any more. Dropped in the 2.2.x I believe.. So if you want to run a passive ftp server behind pfsense you have to forward the passive ports it will use.. And you need to make sure the ftp server actually hands out your public and not its private IP.
This is clickity clickity setup in filezilla server - but it still has to be done.
You need to understand how ftp works to be honest if your going to forward it and not have some helper fix it up for you.. dd-wrt has a helper to auto forward the passive ports and adjust the IP if it sees the server sending out private one.
http://www.slacksite.com/other/ftp.html
If you want some friendly advice - ftp should of been dead years ago… You should move to sftp as it is way more secure and don't have to worry about the control data channel active passive nonsense.
