Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [Solved] I'm apparently unable to port forward...

    Scheduled Pinned Locked Moved Firewalling
    85 Posts 5 Posters 13.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NinoM4sterN
      NinoM4ster
      last edited by johnpoz

      I already called them. they're not blocking anything. and as I said, it works perfectly with my Mikrotik. (with the exact same ports open)

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        Well they are lying or don't understand what your asking... If you sniff and there is nothing there for that port - then pfsense can never forward traffic that doesn't get to it!!

        I have ping going - and NOTING.

        PM you my IP.. Sniff for it..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Get a ping going to my IP... And will validate your coming from that IP..

          keep it running with -t if windows...

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • NinoM4sterN
            NinoM4ster
            last edited by

            I also "sniffed" the port 80, because that's where the web page is hosted on, locally..

            internet > TCP 8889 (WAN) > NAT > TCP 80 192.168.10.6 (my webserver)

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              doesn't matter what you listen on locally!!! If it never gets to your wan then it can not forward it - PERIOD!!! Not rocket science here ;)

              Are you pinging me

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • NinoM4sterN
                NinoM4ster
                last edited by

                https://i.imgur.com/bEfo0vQ.png

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Seem you got ISP issues...

                  Run your continue ping -- while I sniff... And show you that I am answering..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    here - I am answering you!!! IF you not getting it that is on your ISP..

                    0_1540139717159_yourrequest-myreply.png

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • NinoM4sterN
                      NinoM4ster
                      last edited by NinoM4ster

                      I'm gonna shutdown pfSense and switch to Mikrotik to try something..

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @NinoM4ster
                        last edited by johnpoz

                        @ninom4ster

                        And your IP will change! Or you MAC will change - etc etc..

                        What part do you NOT get about pfsense not seeing traffic it can not FORWARD?? Pfsense has no control of what hits is interface or not... Is pfsense a VM? Or hardware?

                        Here is where trace stops
                        inetnum: 177.126.96.0/20
                        aut-num: AS16735
                        abuse-c: CST87
                        owner: ALGAR TELECOM S/A

                        
                        Tracing route to 187.73.x.x over a maximum of 30 hops
                        
                          1    <1 ms    <1 ms    <1 ms  192.168.9.253
                          2    12 ms     9 ms     8 ms  50.4.132.1
                          3     9 ms     8 ms     9 ms  76.73.191.106
                          4    10 ms    10 ms     9 ms  76.73.164.121
                          5     9 ms    12 ms    17 ms  76.73.191.140
                          6    11 ms    10 ms     9 ms  76.73.164.105
                          7    11 ms    13 ms    20 ms  76.73.164.65
                          8    16 ms    12 ms    12 ms  76.73.191.224
                          9    12 ms    12 ms    12 ms  75.76.35.10
                         10    34 ms    35 ms    33 ms  75.76.84.231
                         11    31 ms    32 ms    31 ms  75.76.35.105
                         12   179 ms   178 ms   190 ms  198.32.160.236
                         13   178 ms   180 ms   181 ms  200.150.1.169
                         14   193 ms   176 ms   178 ms  200.150.10.1
                         15   177 ms   176 ms   177 ms  177.126.100.153
                         16     *        *        *     Request timed out.
                         17     *        *        *     Request timed out.
                         18     *        *        *     Request timed out.
                         19     *        *        *     Request timed out.
                         20     *        *        *     Request timed out.
                         21     *        *        *     Request timed out.
                         22     *        *        *     Request timed out.
                         23     *        *        *     Request timed out.
                        

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • NinoM4sterN
                          NinoM4ster
                          last edited by NinoM4ster

                          it's hardware.

                          1 Reply Last reply Reply Quote 0
                          • NinoM4sterN
                            NinoM4ster
                            last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 0
                            • NinoM4sterN
                              NinoM4ster
                              last edited by

                              This post is deleted!
                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                Dude don't worry about it - but Pfsense can not forward what it can not see!!! Period.. If pfsense is not seeing the traffic - then its hardware related or something upstream is blocking it.. Pfsense can not forward what it doesn't get, you can not see an answer to your ping if it doesn't get there..

                                Did you change it what is your IP now?

                                Is this your ISP?
                                ALGAR TELECOM S/A

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by Derelict

                                  @ninom4ster said in I'm apparently unable to port forward...:

                                  am like that.. I want things to FUCKING WORK.
                                  I don't want to debug anything.

                                  Nice.

                                  If the traffic does not arrive on WAN there is nothing for the firewall to forward.

                                  You are going to have to figure out what is going on upstream preventing that traffic from being sent to you. When you have debugged that, your port forward will work. Sorry that maintaining a network is sometimes work. Good luck with your ISP.

                                  That packet capture is before rules, before snort, before everything. The connections from the outside are not arriving on WAN.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  NinoM4sterN 1 Reply Last reply Reply Quote 0
                                  • NinoM4sterN
                                    NinoM4ster @Derelict
                                    last edited by

                                    @johnpoz :

                                    If the traffic does not arrive on WAN there is nothing for the firewall to forward.

                                    @Derelict :

                                    If it never gets to your wan then it can not forward it

                                    Okay, okay... but I don't really understand how I can solve that...

                                    I will soon grab an old notebook and do a clean install of Ubuntu Server with Apache on all the default settings, and also format my current pfSense box.... once again... just to see if the problem is my web server or not..

                                    I don't know what else to try, honestly..

                                    1 Reply Last reply Reply Quote 0
                                    • NinoM4sterN
                                      NinoM4ster
                                      last edited by

                                      ah, I may also try the apparently less buggy version, 2.4.3...

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        It is not a bug - at least not in pfSense. You need to figure out why your upstream/ISP is not forwarding the traffic to you. There is nothing pfSense can do with traffic it never receives.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        NinoM4sterN 1 Reply Last reply Reply Quote 0
                                        • NinoM4sterN
                                          NinoM4ster @Derelict
                                          last edited by

                                          But wait.. isn't the Packet Capture thing supposed to show something up when I "sniff" the WAN? I mean, it's a local procedure, right?
                                          I got confused when you guys told me "it can't forward what it can't see" because I didn't know if you were talking about the WAN or the LAN.

                                          Also, wasn't pfSense supposed to work out-of-the-box? =/
                                          I'm almost sure that it was working perfectly when I first set it up weeks ago.. even port forwarding..

                                          As I already mentioned, it couldn't be my ISP. Port Forwarding works perfectly on my Mikrotik router (when I swap Pf with it).

                                          What's the chance of it being a hardware problem? I'm still not running a Intel NIC since they're unbelievable expensive here where I live..

                                          WAN is the onboard NIC on this MB (apparently Realtek), and LAN is a... (also apparently) Realtek generic gigabit NIC.

                                          Cheers.

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by Derelict

                                            Are you saying you weren't packet capturing on WAN?

                                            If so, do so, and report what you see there. Here's the deal. You are expecting connections from the internet to your WAN address on TCP port 8889. If you packet capture for that traffic ON WAN, test an inbound connection, and the packet capture DOES NOT INCLUDE THAT TRAFFIC then there's nothing pfSense can do. You need to get with your ISP and ask them why they do not forward the traffic to this device but do to that device. It's as simple as that.

                                            If you DO see the traffic then we can work with that.

                                            pfSense does work out of the box for a great many people.

                                            And Realtek NICs are generally considered about as crappy as you can get, but they generally work in most cases.

                                            If Intel is too expensive Broadcom is leaps and bounds better than Realtek.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.