Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Need to allow access to DVR in the WAN network to LAN computers

    Firewalling
    4
    68
    16.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jetberrocal
      last edited by

      My pfsense box is connected to a Cable Modem Router (CMR) with many ports.

      In the CMR there are other devices specifically a DVR.  The DVR get the IP 192.168.0.99.

      The WAN get the IP 192.168.0.3.

      The LAN subnet is 192.168.1.0/24

      I can ping from the LAN to IP 192.168.0.99.  I do not know if I can ping from a device in the WAN network to the LAN but I guess not.

      Even that I can ping the DVR I can't connect to it to receive its feed.

      So I think that I need to create a Firewall Rule to allow the communication.

      The Default Firewall rules are active.

      Any one could tell me what rule to add?

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        You've got a double-NAT situation.  pfSense can control access from WAN to LAN, but your DVR is on the same network as WAN so pfSense won't be able to do much about it.  You need to configure your CMR to port-forward the DVR.  You would be better off with your modem in bridge mode, with pfSense after that and a small switch with your DVR after that.  Then you could control everything via pfSense.

        1 Reply Last reply Reply Quote 0
        • J
          jetberrocal
          last edited by

          Before installing the pfsense they had a netgear wireless router working as firewall.  This device was working before while using that router.
          I guessed pfsense should be capable to be better or equal to that netgear.

          Maybe there is a way to turn off NATting between the DVR and the LAN subnet?

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            "Maybe there is a way to turn off NATting between the DVR and the LAN subnet?"

            Yes there is a way to do that, but your still going to have a asymmetrical routing issue, nat would actually be your friend here.

            The default lan rules are any any so that would allow your communication.  And pfsense should nat the connection to its wan IP so it would be like you were talking to the dvr from your pfsense wan IP..  So there should be no reason you shouldn't be able to connect to your dvr.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • J
              jetberrocal
              last edited by

              I dont know why is not working.

              I connected to the DVR web service and downloaded successfully an application from it.

              Went to IE using http://192.168.0.99:99 the DVR showed a Web Page to download its clients. (I downloaded the IE add-on successfully and the Windows client successfully.  It even asks for username/password which I entered and was accepted.

              But then the add-on and the windows client when try to get the feed from the DVR failed with some app error.

              Other clients that are connected directly to the CMR can get the feed without error so I know the DVR is giving the feed.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                are you using proxy in pfsense?

                Without understanding how the client works it is hard to say what could be the problem.  Maybe the client reports its IP to the dvr, and the dvr is trying to get to that 192.168.1 address by talking to its gateway vs the IP that is natted by pfsense to be on the dvr network?

                Why are you putting pfsense downstream of your cable devices.

                Why don't you put your pfsense in front of ALL your devices.  Either put them all on the same network/vlan behind pfsense or put them on their own segments behind pfsense.  But pfsense because now the gateway/router for all your devices.

                Pfsense wan would be connected to your cable devices, I would even put them into bridge mode so pfsense wan gets actual public IPs.. Then all your devices should be behind pfsense.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  jetberrocal
                  last edited by

                  Yes.  But I am testing the DVR client in the server which connects without proxy.  (I have Captive Portal to block direct access to the Internet but the server is allowed to pass)

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Are you running any sort of ips, like snort or the other one?  Again without understanding how the client works its hard to guess what the problem is, clearly your saying you can access it via http.  But maybe the client uses multicast to stream shows or something?  Multicast is doesn't really work over a layer 3 route or nat - its designed to be on the same layer 2 network.

                    You need to understand how the client works with the dvr to know what could be causing the problem.  But from a normal networking point of view, pfsense nats your client talking to dvr to look like its coming from pfsense WAN IP that is on the dvr network.

                    Maybe it has something to do with the source port needing to be static or something?  Since pfsense would be doing napt and changing the sourceport of the connection.  There are lots of things that could break it from working correctly through a nat.

                    I still do not understand why your putting pfsense downstream?  This is not a good setup.  Pfsense should be at the edge and can route between your multiple segments if you need/want them.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • J
                      jetberrocal
                      last edited by

                      @johnpoz:

                      Are you running any sort of ips, like snort or the other one?  Again without understanding how the client works its hard to guess what the problem is, clearly your saying you can access it via http.  But maybe the client uses multicast to stream shows or something?  Multicast is doesn't really work over a layer 3 route or nat - its designed to be on the same layer 2 network.

                      I can install snort in the pfsense if you say that it could shed light to the problem.  Maybe the client does use multicast to stream I cant tell.

                      @johnpoz:

                      I still do not understand why your putting pfsense downstream?  This is not a good setup.  Pfsense should be at the edge and can route between your multiple segments if you need/want them.

                      The network Admin has it that way.  I am just replacing the netgear by the pfsense to implement proxy and content filtering.  The netgear was reconfigured to act as a Wireless AP.

                      Maybe I can convince the Net Admin to change the DVR to the internal network, then I will have to add a Port Forward to the DVR as they connect to it from the Internet by Cellular Apps.  If multicast is a problem in this method then I will have a unsatisfied Client.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        If your netgear was just being a AP then it wasn't doing any sort of nat.. And wasn't routing or anything it was just an AP.

                        No I would not suggest installing snort.  What I would suggest you could do is sniff on pfsense lan and wan and try and make a connection to see what is going on.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • J
                          jetberrocal
                          last edited by

                          @johnpoz:

                          If your netgear was just being a AP then it wasn't doing any sort of nat.. And wasn't routing or anything it was just an AP.

                          It was converted to AP after pfsense installation, before pfsense it was the main Router/Firewall.

                          @johnpoz:

                          No I would not suggest installing snort.  What I would suggest you could do is sniff on pfsense lan and wan and try and make a connection to see what is going on.

                          OK.  There is a sniff package?

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            no package just under diagnostics, packet capture or fro ma prompt or ssh to it you can do tcpdump

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • J
                              jetberrocal
                              last edited by

                              I search and found this:
                              https://doc.pfsense.org/index.php/Sniffers,_Packet_Capture

                              1 Reply Last reply Reply Quote 0
                              • J
                                jetberrocal
                                last edited by

                                Run Diagnostic -> Packet Capture

                                Set Host to 192.168.0.99
                                Else left defaults.

                                Output:

                                17:10:04.638345 ARP, Request who-has 192.168.0.99 tell 192.168.0.3, length 28
                                17:10:04.639323 ARP, Reply 192.168.0.99 is-at 00:17:4f:0c:3e:5c, length 46
                                17:10:04.639332 IP 192.168.0.3.16730 > 192.168.0.99.99: tcp 0
                                17:10:04.765719 IP 192.168.0.3.35783 > 192.168.0.99.99: tcp 0
                                17:10:04.765982 IP 192.168.0.99.99 > 192.168.0.3.35783: tcp 0
                                17:10:04.766120 IP 192.168.0.3.35783 > 192.168.0.99.99: tcp 0
                                17:10:04.766265 IP 192.168.0.3.35783 > 192.168.0.99.99: tcp 259
                                17:10:04.766602 IP 192.168.0.99.99 > 192.168.0.3.35783: tcp 0
                                17:10:04.807060 IP 192.168.0.99.99 > 192.168.0.3.35783: tcp 999
                                17:10:04.807116 IP 192.168.0.99.99 > 192.168.0.3.35783: tcp 0
                                17:10:04.807222 IP 192.168.0.3.35783 > 192.168.0.99.99: tcp 0
                                17:10:04.807622 IP 192.168.0.3.35783 > 192.168.0.99.99: tcp 0
                                17:10:04.808025 IP 192.168.0.3.18835 > 192.168.0.99.99: tcp 0
                                17:10:04.809060 IP 192.168.0.99.99 > 192.168.0.3.35783: tcp 0
                                17:10:04.809262 IP 192.168.0.99.99 > 192.168.0.3.18835: tcp 0
                                17:10:04.809378 IP 192.168.0.3.18835 > 192.168.0.99.99: tcp 0
                                17:10:04.809915 IP 192.168.0.3.18835 > 192.168.0.99.99: tcp 298
                                17:10:04.810486 IP 192.168.0.99.99 > 192.168.0.3.18835: tcp 0
                                17:10:04.820361 IP 192.168.0.99.99 > 192.168.0.3.18835: tcp 17
                                17:10:05.017506 IP 192.168.0.3.18835 > 192.168.0.99.99: tcp 0
                                17:10:05.075790 IP 192.168.0.99.99 > 192.168.0.3.18835: tcp 1024
                                17:10:05.084769 IP 192.168.0.99.99 > 192.168.0.3.18835: tcp 95
                                17:10:05.084930 IP 192.168.0.3.18835 > 192.168.0.99.99: tcp 0
                                17:10:05.089531 IP 192.168.0.3.18835 > 192.168.0.99.99: tcp 0
                                17:10:05.089864 IP 192.168.0.99.99 > 192.168.0.3.18835: tcp 0
                                17:10:05.236533 IP 192.168.0.3.33284 > 192.168.0.99.99: tcp 0
                                17:10:05.236766 IP 192.168.0.99.99 > 192.168.0.3.33284: tcp 0
                                17:10:05.236900 IP 192.168.0.3.33284 > 192.168.0.99.99: tcp 0
                                17:10:05.236975 IP 192.168.0.3.33284 > 192.168.0.99.99: tcp 92
                                17:10:05.237352 IP 192.168.0.99.99 > 192.168.0.3.33284: tcp 0
                                17:10:05.253688 IP 192.168.0.99.99 > 192.168.0.3.33284: tcp 201
                                17:10:05.254600 IP 192.168.0.99.99 > 192.168.0.3.33284: tcp 997
                                17:10:05.254732 IP 192.168.0.3.33284 > 192.168.0.99.99: tcp 0
                                17:10:05.254790 IP 192.168.0.3.33284 > 192.168.0.99.99: tcp 0
                                17:10:05.255046 IP 192.168.0.99.99 > 192.168.0.3.33284: tcp 0
                                17:10:05.356100 IP 192.168.0.3.10889 > 192.168.0.99.99: tcp 0
                                17:10:05.356342 IP 192.168.0.99.99 > 192.168.0.3.10889: tcp 0
                                17:10:05.356482 IP 192.168.0.3.10889 > 192.168.0.99.99: tcp 0
                                17:10:05.356610 IP 192.168.0.3.10889 > 192.168.0.99.99: tcp 72
                                17:10:05.356870 IP 192.168.0.99.99 > 192.168.0.3.10889: tcp 0
                                17:10:05.366405 IP 192.168.0.99.99 > 192.168.0.3.10889: tcp 522
                                17:10:05.366637 IP 192.168.0.99.99 > 192.168.0.3.10889: tcp 0
                                17:10:05.366829 IP 192.168.0.3.10889 > 192.168.0.99.99: tcp 0
                                17:10:05.370377 IP 192.168.0.3.10889 > 192.168.0.99.99: tcp 0
                                17:10:05.370472 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:05.371335 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 0
                                17:10:05.371449 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:05.371559 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 177
                                17:10:05.371569 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 242
                                17:10:05.372071 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 0
                                17:10:05.372079 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 0
                                17:10:48.857694 IP 192.168.0.3.62699 > 192.168.0.99.99: tcp 0
                                17:10:48.858534 IP 192.168.0.99.99 > 192.168.0.3.62699: tcp 0
                                17:10:48.858667 IP 192.168.0.3.62699 > 192.168.0.99.99: tcp 0
                                17:10:48.858788 IP 192.168.0.3.62699 > 192.168.0.99.99: tcp 92
                                17:10:48.859469 IP 192.168.0.99.99 > 192.168.0.3.62699: tcp 0
                                17:10:48.905379 IP 192.168.0.99.99 > 192.168.0.3.62699: tcp 201
                                17:10:48.911684 IP 192.168.0.99.99 > 192.168.0.3.62699: tcp 997
                                17:10:48.911867 IP 192.168.0.3.62699 > 192.168.0.99.99: tcp 0
                                17:10:48.911937 IP 192.168.0.3.62699 > 192.168.0.99.99: tcp 0
                                17:10:48.912247 IP 192.168.0.99.99 > 192.168.0.3.62699: tcp 0
                                17:10:48.959143 IP 192.168.0.3.20616 > 192.168.0.99.99: tcp 0
                                17:10:48.960577 IP 192.168.0.99.99 > 192.168.0.3.20616: tcp 0
                                17:10:48.960737 IP 192.168.0.3.20616 > 192.168.0.99.99: tcp 0
                                17:10:48.960790 IP 192.168.0.3.20616 > 192.168.0.99.99: tcp 72
                                17:10:48.961003 IP 192.168.0.99.99 > 192.168.0.3.20616: tcp 0
                                17:10:48.966558 IP 192.168.0.99.99 > 192.168.0.3.20616: tcp 522
                                17:10:48.966807 IP 192.168.0.99.99 > 192.168.0.3.20616: tcp 0
                                17:10:48.966935 IP 192.168.0.3.20616 > 192.168.0.99.99: tcp 0
                                17:10:48.970327 IP 192.168.0.3.20616 > 192.168.0.99.99: tcp 0
                                17:10:48.970449 IP 192.168.0.3.46976 > 192.168.0.99.99: tcp 0
                                17:10:48.971139 IP 192.168.0.99.99 > 192.168.0.3.46976: tcp 0
                                17:10:48.971254 IP 192.168.0.3.46976 > 192.168.0.99.99: tcp 0
                                17:10:48.971370 IP 192.168.0.3.46976 > 192.168.0.99.99: tcp 177
                                17:10:48.971380 IP 192.168.0.3.46976 > 192.168.0.99.99: tcp 242
                                17:10:48.971767 IP 192.168.0.99.99 > 192.168.0.3.46976: tcp 0
                                17:10:48.971774 IP 192.168.0.99.99 > 192.168.0.3.46976: tcp 0
                                17:10:49.086703 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1024
                                17:10:49.086780 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.086869 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.086923 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:49.087251 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 803
                                17:10:49.087359 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:49.103297 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 177
                                17:10:49.103332 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 241
                                17:10:49.103554 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 0
                                17:10:49.103641 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 0
                                17:10:49.117235 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1024
                                17:10:49.117264 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.117441 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:49.117445 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.117460 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.117602 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:49.117605 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.117681 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.117792 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1460
                                17:10:49.117812 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:49.118723 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 456
                                17:10:49.118867 IP 192.168.0.3.10010 > 192.168.0.99.99: tcp 0
                                17:10:49.122663 IP 192.168.0.99.99 > 192.168.0.3.10010: tcp 1024

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Yeah your going to want too download that into say wireshark.. That is just not enough info to try and figure out what is going on.  But I don't see any multicast.  But if you limited to IP then you wouldn't see that.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jetberrocal
                                    last edited by

                                    Repeat with same host but instead of normal selected full detail

                                    Output:

                                    17:15:07.399030 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 127, id 26372, offset 0, flags [DF], proto TCP (6), length 52)
                                        192.168.0.3.65355 > 192.168.0.99.99: Flags ~~, cksum 0x85d2 (correct), seq 3148123187, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
                                    17:15:07.399482 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
                                        192.168.0.99.99 > 192.168.0.3.65355: Flags [S.], cksum 0x8615 (correct), seq 769112275, ack 3148123188, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 1], length 0
                                    17:15:07.399616 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26373, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.65355 > 192.168.0.99.99: Flags [.], cksum 0xfee9 (correct), seq 1, ack 1, win 256, length 0
                                    17:15:07.399732 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 146: (tos 0x0, ttl 127, id 26374, offset 0, flags [DF], proto TCP (6), length 132)
                                        192.168.0.3.65355 > 192.168.0.99.99: Flags [P.], cksum 0x629a (correct), seq 1:93, ack 1, win 256, length 92
                                    17:15:07.400436 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 33162, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.99.99 > 192.168.0.3.65355: Flags [.], cksum 0xe309 (correct), seq 1, ack 93, win 7300, length 0
                                    17:15:07.449709 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 255: (tos 0x0, ttl 64, id 33163, offset 0, flags [DF], proto TCP (6), length 241)
                                        192.168.0.99.99 > 192.168.0.3.65355: Flags [P.], cksum 0x83ce (correct), seq 1:202, ack 93, win 7300, length 201
                                    17:15:07.452072 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 1051: (tos 0x0, ttl 64, id 33164, offset 0, flags [DF], proto TCP (6), length 1037)
                                        192.168.0.99.99 > 192.168.0.3.65355: Flags [FP.], cksum 0xb8f8 (correct), seq 202:1199, ack 93, win 7300, length 997
                                    17:15:07.452300 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26376, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.65355 > 192.168.0.99.99: Flags [.], cksum 0xf9e3 (correct), seq 93, ack 1200, win 251, length 0
                                    17:15:07.452350 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26377, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.65355 > 192.168.0.99.99: Flags [F.], cksum 0xf9e2 (correct), seq 93, ack 1200, win 251, length 0
                                    17:15:07.452542 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.99.99 > 192.168.0.3.65355: Flags [.], cksum 0xde59 (correct), seq 1200, ack 94, win 7300, length 0
                                    17:15:07.496404 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 127, id 26386, offset 0, flags [DF], proto TCP (6), length 52)
                                        192.168.0.3.15956 > 192.168.0.99.99: Flags ~~, cksum 0x2e9c (correct), seq 4130761167, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
                                    17:15:07.496687 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
                                        192.168.0.99.99 > 192.168.0.3.15956: Flags [S.], cksum 0x09fe (correct), seq 329906146, ack 4130761168, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 1], length 0
                                    17:15:07.496819 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26387, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.15956 > 192.168.0.99.99: Flags [.], cksum 0x82d2 (correct), seq 1, ack 1, win 256, length 0
                                    17:15:07.496870 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 126: (tos 0x0, ttl 127, id 26388, offset 0, flags [DF], proto TCP (6), length 112)
                                        192.168.0.3.15956 > 192.168.0.99.99: Flags [P.], cksum 0xbc2d (correct), seq 1:73, ack 1, win 256, length 72
                                    17:15:07.498456 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 52875, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.99.99 > 192.168.0.3.15956: Flags [.], cksum 0x6706 (correct), seq 1, ack 73, win 7300, length 0
                                    17:15:07.512679 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 576: (tos 0x0, ttl 64, id 52876, offset 0, flags [DF], proto TCP (6), length 562)
                                        192.168.0.99.99 > 192.168.0.3.15956: Flags [P.], cksum 0xf776 (correct), seq 1:523, ack 73, win 7300, length 522
                                    17:15:07.513030 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 52877, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.99.99 > 192.168.0.3.15956: Flags [F.], cksum 0x64fb (correct), seq 523, ack 73, win 7300, length 0
                                    17:15:07.513150 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26390, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.15956 > 192.168.0.99.99: Flags [.], cksum 0x8081 (correct), seq 73, ack 524, win 254, length 0
                                    17:15:07.516451 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26391, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.15956 > 192.168.0.99.99: Flags [R.], cksum 0x817b (correct), seq 73, ack 524, win 0, length 0
                                    17:15:07.516539 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 127, id 26392, offset 0, flags [DF], proto TCP (6), length 52)
                                        192.168.0.3.1278 > 192.168.0.99.99: Flags ~~, cksum 0x8c3b (correct), seq 1103755763, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
                                    17:15:07.518703 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
                                        192.168.0.99.99 > 192.168.0.3.1278: Flags [S.], cksum 0xd1a7 (correct), seq 138385730, ack 1103755764, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 1], length 0
                                    17:15:07.518848 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 26393, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.1278 > 192.168.0.99.99: Flags [.], cksum 0x4a7c (correct), seq 1, ack 1, win 256, length 0
                                    17:15:07.518959 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 231: (tos 0x0, ttl 127, id 26394, offset 0, flags [DF], proto TCP (6), length 217)
                                        192.168.0.3.1278 > 192.168.0.99.99: Flags [P.], cksum 0x0b3d (correct), seq 1:178, ack 1, win 256, length 177
                                    17:15:07.518969 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 296: (tos 0x0, ttl 127, id 26395, offset 0, flags [DF], proto TCP (6), length 282)
                                        192.168.0.3.1278 > 192.168.0.99.99: Flags [P.], cksum 0x140b (correct), seq 178:420, ack 1, win 256, length 242
                                    17:15:07.519914 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 41001, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.99.99 > 192.168.0.3.1278: Flags [.], cksum 0x2e47 (correct), seq 1, ack 178, win 7300, length 0
                                    17:15:07.520037 00:17:4f:0c:3e:5c > 00:0c:29:87:39:2f, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 41002, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.99.99 > 192.168.0.3.1278: Flags [.], cksum 0x2d55 (correct), seq 1, ack 420, win 7300, length 0
                                    17:16:13.271446 00:0c:29:87:39:2f > 00:17:4f:0c:3e:5c, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 127, id 29332, offset 0, flags [DF], proto TCP (6), length 40)
                                        192.168.0.3.1278 > 192.168.0.99.99: Flags [R.], cksum 0x49d5 (correct), seq 420, ack 1, win 0, length 0

                                    Something in the output make it stricke with a line.~~~~~~

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jetberrocal
                                      last edited by

                                      Change .cap to .txt to be able to download.

                                      packetcapture.txt

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jetberrocal
                                        last edited by

                                        @johnpoz:

                                        Yeah your going to want too download that into say wireshark.. That is just not enough info to try and figure out what is going on.  But I don't see any multicast.  But if you limited to IP then you wouldn't see that.

                                        I dont have wireshark and has never use it before.  I guess I can download if it is free, but use it is other story.

                                        1 Reply Last reply Reply Quote 0
                                        • KOMK
                                          KOM
                                          last edited by

                                          https://www.wireshark.org/

                                          Yes it is free (v2.2.1 was just released), and there are a lot of tutorials online as to how to use it.  Everyone who is responsible for maintaining a routing firewall should be familiar with packet capture and analysis.  There are several books on Wireshark and you can even get training:

                                          http://www.wiresharktraining.com/

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jetberrocal
                                            last edited by

                                            Found some threads about RSTP but I think this are pertinent for devices in the internal network serving streaming to the external network or Internet:

                                            https://www.mail-archive.com/support@pfsense.com/msg17749.html
                                            https://www.mail-archive.com/support@pfsense.com/msg17758.html

                                            https://doc.pfsense.org/index.php/Static_Port
                                            http://www.selectedintelligence.com/post/46429611973/pfsense-rtsp-and-rtp

                                            But my case is inverted the source and destination, as the RSTP device is in the external network and the clients are in the internal network.

                                            If this is pertinent to my problem could you explain to me in basic terms.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.