Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't reach own server (HTTP) from outside the network

    Scheduled Pinned Locked Moved Firewalling
    35 Posts 3 Posters 4.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Use console option 15 and restore the config from before you made the change.

      You have something configured in a decidedly unorthodox fashion if that made any sort of difference.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • B
        brechtb
        last edited by

        Ok, I used option 15, and I got my previous setup back, let's ignore port 80 for now, and focus on port 5050 for example.

        I changed one port to the following in the attachment, but it doesn't work either.

        edit by the way, port forward 32400 (PLEX) works, I can access Plex from outside, just not the websites I have running on my server

        Capture.PNG
        Capture.PNG_thumb
        Capture2.PNG
        Capture2.PNG_thumb

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Dude. Did you go through the checklist here?

          https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

          That covers about every possible thing that could keep your port forward from working.

          You are getting pretty clicky-clicky. There is no reason to dork with NAT reflection when testing from outside. There is no reason to change the associated filter rule from Create associated rule to Pass. This stuff really does work. If you do the basics and it does not work it is probably something in the troubleshooting checklist posted earlier.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • B
            brechtb
            last edited by

            @Derelict:

            Dude. Did you go through the checklist here?

            https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

            That covers about every possible thing that could keep your port forward from working.

            Yes dude, I checked the checklist here, client allows port 5050 in the firewall, client has default gateway address pointing to the pfsense router, ISP doesn't block it (it worked with my previous router), there's a router before pfsense too (my modem) and there the port forwards are also set (I left it like it was with my previous setup that worked), I have no virtual IP, that may be the problem maybe? The WAN connection is set as the default gateway. I can access the website through LAN. WAN rules don't have a gateway set.

            Really, I checked it and it seems to be configured correctly, I just followed the guide on portforwards in pfSense and did exactly like the guide said.

            I understand that you might be a bit frustrated because you might think that I'm not listening to you, but I am, I want this problem to be solved too and I'm doing all the suggestions you give me, thanks BTW.

            At first I though it might be a DNS problem, but when I try connect to the website via IP address it also doesn't work.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              My problem is if you had done all that it would be working.

              Guess packet captures of connection attempts on all the pertinent interfaces are in order.

              Anything interesting in the firewall logs filtered on port 5050?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • B
                brechtb
                last edited by

                I cleared the log file in Status > System Logs > Firewall > Normal View, then I browsed to the website on port 5050 (WAN1) and there I no entry in the logfile for that port.

                I attached screenshot of a part of the log file.

                If the firewall doesn't block it, does that mean that the portforward is correctly configured and that it is another problem?

                Sorry, i didn't filter it, but i attached a filtered view, no entries….

                Capture.PNG
                Capture.PNG_thumb
                Capture.PNG
                Capture.PNG_thumb

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Or it means the traffic is not arriving on WAN1 in the first place. I would packet capture on port 5050 on WAN1, attempt again, and see what it shows.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • B
                    brechtb
                    last edited by

                    Yes, you are right, no packets are captured on port 5050,

                    So it is a problem with something else…

                    Attached is how my setup is configured

                    EDIT: there are packets captured, I didn't know that I had to stop the packet capturing to see the results, here are the results:

                    11:44:39.806615 IP 81.240.101.105.12852 > 109.134.116.205.5050: tcp 0
                    11:44:40.794383 IP 81.240.101.105.12852 > 109.134.116.205.5050: tcp 0
                    11:44:42.807943 IP 81.240.101.105.12852 > 109.134.116.205.5050: tcp 0
                    11:44:46.815748 IP 81.240.101.105.31786 > 109.134.116.205.5050: tcp 0
                    11:44:47.830415 IP 81.240.101.105.31786 > 109.134.116.205.5050: tcp 0
                    11:44:49.831286 IP 81.240.101.105.31786 > 109.134.116.205.5050: tcp 0

                    The first IP is correct, the second IP is an old public IP (I have a dynamic IP)

                    Capture.PNG
                    Capture.PNG_thumb

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      It must be in the upstream device. Have to look there. pfSense can't do anything with packets it doesn't receive.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • B
                        brechtb
                        last edited by

                        EDIT: there are packets captured, I didn't know that I had to stop the packet capturing to see the results, here are the results:

                        11:44:39.806615 IP 81.240.101.105.12852 > 109.134.116.205.5050: tcp 0
                        11:44:40.794383 IP 81.240.101.105.12852 > 109.134.116.205.5050: tcp 0
                        11:44:42.807943 IP 81.240.101.105.12852 > 109.134.116.205.5050: tcp 0
                        11:44:46.815748 IP 81.240.101.105.31786 > 109.134.116.205.5050: tcp 0
                        11:44:47.830415 IP 81.240.101.105.31786 > 109.134.116.205.5050: tcp 0
                        11:44:49.831286 IP 81.240.101.105.31786 > 109.134.116.205.5050: tcp 0

                        The first IP is correct, the second IP is an old public IP (I have a dynamic IP)

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          What do you mean old? If it is not an IP address the firewall thinks is valid the packets will not be processed properly.

                          If 109.134.116.205 is not WAN1 address your port forwards won't match.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • B
                            brechtb
                            last edited by

                            @Derelict:

                            What do you mean old? If it is not an IP address the firewall thinks is valid the packets will not be processed properly.

                            By old IP address I mean, I got this IP 109.134.116.205 on WAN1 (PPPOE), the I rebooted pfSense and I got the 81.240.101.105  as public IP, so why is there an previous IP in the packet capture

                            edit,

                            Ok so I went to http://81.240.101.105:5050/ and now I get this:

                            11:52:55.236104 IP 81.240.101.105.49690 > 192.168.1.2.5050: tcp 0
                            11:52:56.242128 IP 81.240.101.105.49690 > 192.168.1.2.5050: tcp 0
                            11:52:58.255926 IP 81.240.101.105.49690 > 192.168.1.2.5050: tcp 0
                            11:53:04.169001 IP 81.240.101.105.40373 > 192.168.1.2.5050: tcp 0
                            11:53:05.177315 IP 81.240.101.105.40373 > 192.168.1.2.5050: tcp 0
                            11:53:07.177541 IP 81.240.101.105.40373 > 192.168.1.2.5050: tcp 0

                            But the 192.168.1.2.5050 should be 192.168.1.3:5050

                            That was the old config (resetted the backup) TIME FOR A REBOOT

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              So if you think packets are arriving on WAN1 properly, then the next step is to capture on whatever interface is connected to 192.168.1.2, filtered on port 5050, attempt again, and see what it shows.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • B
                                brechtb
                                last edited by

                                After reboot I get this:

                                11:59:04.197040 IP 91.179.143.196.20247 > 192.168.1.3.5050: tcp 0

                                Now 192.168.1.3 is correct!
                                Still no page to be seen (can't reach this page)

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  People and their cockamamie ISPs and their cockamamie setups. Lord help me.

                                  What does pfSense think its WAN1 address is?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    brechtb
                                    last edited by

                                    I did like you asked me, I set the interface on LAN in the packet capture, now it shows this:

                                    12:01:34.271204 IP 192.168.1.36.30707 > 91.179.143.196.5050: tcp 0
                                    12:01:35.289181 IP 192.168.1.36.30707 > 91.179.143.196.5050: tcp 0
                                    12:01:37.301240 IP 192.168.1.36.30707 > 91.179.143.196.5050: tcp 0
                                    12:01:46.976702 IP 192.168.1.36.30729 > 91.179.143.196.5050: tcp 0
                                    12:01:47.968153 IP 192.168.1.36.30729 > 91.179.143.196.5050: tcp 0
                                    12:01:49.975529 IP 192.168.1.36.30729 > 91.179.143.196.5050: tcp 0

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      brechtb
                                      last edited by

                                      @Derelict:

                                      People and their cockamamie ISPs and their cockamamie setups. Lord help me.

                                      What does pfSense think its WAN1 address is?

                                      See attachment

                                      Capture2.PNG
                                      Capture2.PNG_thumb

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        I have zero idea about what you are seeing, bro. None. There is something you are not telling us. I am done with this thread for at least 18 hours. Maybe someone else can help.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          brechtb
                                          last edited by

                                          @Derelict:

                                          I have zero idea about what you are seeing, bro. None. There is something you are not telling us. I am done with this thread for at least 18 hours. Maybe someone else can help.

                                          Ok, thanks anyway, the only thing I didn't say is that I have a Multiwan setup (loadbalancing + failover wan1 + failover wan2)

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            In your drawing you show "modem" with port forwards enabled??  But then you show pfsense with public IPs on its wan..  That makes NO sense..

                                            So your outside and trying to go to your wan1 IP 91.179.143.196.5050

                                            And you want this 5050 to be forwarded too 192.168.1.2 that is what you show in your port forwards..

                                            When then why do you show this traffic on your lan from some other box?

                                            12:01:34.271204 IP 192.168.1.36.30707 > 91.179.143.196.5050: tcp 0
                                            12:01:35.289181 IP 192.168.1.36.30707 > 91.179.143.196.5050: tcp 0

                                            What is this 192.168.1.36 machine?  He is trying to access your public wan IP from inside your network, so you want nat reflection to work??  If you want box on your network to talk to 192.168.1.2 why do you not just talk to it directly vs going to your wan IP via I am guessing some dyndns fqdn that points to your wan??

                                            The traffic your interested in would be coming from some public IP going to your 192.168.1.2 box that you say is not working.. Well sniff on your wan using this 192.168.1.2 as the host IP or the public IP your coming from in the packet capture filter so you don't see data that is not what your looking for.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.