[Solved] I'm apparently unable to port forward...
-
It is not a bug - at least not in pfSense. You need to figure out why your upstream/ISP is not forwarding the traffic to you. There is nothing pfSense can do with traffic it never receives.
-
But wait.. isn't the Packet Capture thing supposed to show something up when I "sniff" the WAN? I mean, it's a local procedure, right?
I got confused when you guys told me "it can't forward what it can't see" because I didn't know if you were talking about the WAN or the LAN.Also, wasn't pfSense supposed to work out-of-the-box? =/
I'm almost sure that it was working perfectly when I first set it up weeks ago.. even port forwarding..As I already mentioned, it couldn't be my ISP. Port Forwarding works perfectly on my Mikrotik router (when I swap Pf with it).
What's the chance of it being a hardware problem? I'm still not running a Intel NIC since they're unbelievable expensive here where I live..
WAN is the onboard NIC on this MB (apparently Realtek), and LAN is a... (also apparently) Realtek generic gigabit NIC.
Cheers.
-
Are you saying you weren't packet capturing on WAN?
If so, do so, and report what you see there. Here's the deal. You are expecting connections from the internet to your WAN address on TCP port 8889. If you packet capture for that traffic ON WAN, test an inbound connection, and the packet capture DOES NOT INCLUDE THAT TRAFFIC then there's nothing pfSense can do. You need to get with your ISP and ask them why they do not forward the traffic to this device but do to that device. It's as simple as that.
If you DO see the traffic then we can work with that.
pfSense does work out of the box for a great many people.
And Realtek NICs are generally considered about as crappy as you can get, but they generally work in most cases.
If Intel is too expensive Broadcom is leaps and bounds better than Realtek.
-
The picture he posted was on his WAN.. There was nothing there to port 8889..
You want to meet the train engineer - hard to meet him if the train never pulls into the station.. So how could pfsense forward traffic to a device on your lan, if it never sees it on the wan.. This isn't freaking rocket science here ;)
You say it works on your old router.. Well that router going to be a different IP, its going to be a different MAC address of the device connected to the isp. Your isp could be filtering on unknown mac? What is the device your connecting pfsense too exactly what is the make and model number? When you connect pfsense to this device - you actually see the public IP on pfsense wan? 187.73.x.x ?? Or do you see some other IP like 192.168.x.x, 10.x.x.x or 172.16-31.x.x ??
If you do not get the public IP yuo say is yours on the the wan interface of pfsense - then it is behind a NAT. And the device doing that nat has to be told to send the specific traffic to pfsense WAN ip.. or no pfsense will never see the traffic to be able to forward to your 192.168 box on your lan.
-
I understand enough about NAT. It is indeed exposed externally, since the WAN does get an external address. I know what I'm doing.
I just noticed that I got something wrong when I tried using the Packet Capture.. I was really tired and for some reason I thought it generated traffic itself, somehow.. (don't blame me, it was 3 in the morning..) so that's probably why it was blank..
I might try again another day.. Unfortunately I can't simply shutdown everything (to swap the devices) since my dad uses the Internet constantly for wotk..
Cheers.
-
So what is your public IP now - PM it to me.. And validate that it answers ping.. And if the port forward works, etc.
Cuz the IP you sent me still is not answering ping.. So whats the IP when you use this other router..
-
Sent.
And btw, my ISP shouldn't block unknown Mac, or else I wouldn't have internet access at all. not even outgoing.
-
Doesn't always work that way.. Many an isp allows mac address for some access until its registered, etc. Is quite possible for you to have 1 sort of access with known mac, and then limited sort of access when you have another mac until it gets registered, etc.
Your IPs are in completely different net blocks.. So its possible traffic inbound works on netblock A, but not when using netblock B..
BTW your new IP doesn't ping either.. But I do show 8889 being open.
How come you could not ping my IP? Can you ping my IP now? I showed you when you pinged me before I that I sent a reply.. But you didn't get it, etc. Its possible maybe they have issues on the netblock you get when you install pfsense. Simple test of that would be to clone the mac address of your router so that pfsense uses the same mac on its wan.. This way you "should" get the exact same address as this router for your wan.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
Why are most of the posts deleted in this topic? I was looking forward to following the story.
Jeff
-
The OP deleted them - you would have to ask him why he deleted them.. he had some screenshots in them. But none of which showed any personal info, etc.
If the OP wanted them deleted that is his call.
-
This post is deleted! -
@johnpoz Yes, I was thinking about spoofing the WAN mac..
About the public address block, I also don't know how they work.. sometimes I get 186.X, sometimes 187.X, and sometimes even 201.X.. it's really weird..
I'll check right now if I have ICMP rule enabled here...yes, I do....And will also try to ping your IP (though I already did that with no success the other day)Yeah, no response..Weird thing is that I can ping your IP using this tool.
-
@johnpoz :
Is this your ISP?
ALGAR TELECOM S/AAh, sorry.. no, it's not. My ISP (ViaReal) probably use AlgarTelecom's route.
I ran a Traceroute to your IP and it stopped at
eqix-dc2.wideopenwest.com [206.126.236.136]. Can you try one at my direction and send me the screenshot?Thanks.
-
So your ISP is forwarding outbound connections from you but dropping inbound connections. You'll have to ask them why that is.
-
Look at this NONSENSE tracing to you..
>tracert -d 201.162.x.x Tracing route to 201.162.x.x over a maximum of 30 hops 1 <1 ms <1 ms <1 ms 192.168.9.253 2 10 ms 11 ms 11 ms 50.4.132.1 3 9 ms 9 ms 9 ms 76.73.191.106 4 31 ms 11 ms 9 ms 76.73.164.121 5 10 ms 12 ms 11 ms 76.73.191.140 6 12 ms 12 ms 12 ms 76.73.164.105 7 10 ms 10 ms 19 ms 76.73.164.65 8 20 ms 11 ms 23 ms 76.73.191.224 9 19 ms 11 ms 15 ms 75.76.35.10 10 32 ms 35 ms 32 ms 75.76.84.231 11 31 ms 32 ms 32 ms 75.76.35.105 12 154 ms 155 ms 156 ms 198.32.160.236 13 157 ms 161 ms 156 ms 200.150.1.169 14 155 ms 155 ms 158 ms 200.150.10.1 15 176 ms 173 ms 173 ms 177.126.100.153 16 175 ms 174 ms 177 ms 10.0.20.19016 175 ms 174 ms 177 ms 10.0.20.190
-
Not quite sure how you got those responses at all there.
-
Yeah I don't either clearly something WAY wrong there.. Should be impossible to get such an answer.
-
I suppose it's possible that nobody along the path is filtering for that.
-
So your ISP is forwarding outbound connections from you but dropping inbound connections.
That's not totally true.. my friend from a city far away can ping me with no problems. And also, I can't ping John's address either, so I guess the problem is up higher... I can get past Algar which I guess is my ISP's route, and John can get up to Algar in the opposite way..
I really don't freaking know what's happening, but I've seen it before.. A few months ago I tried to, but I couldn't access a website my friend from the US was hosting at his place, and he narrowed it down to be a Comcast router blocking incoming traffic from me (I'm in Brazil).
So, what I meant with all this is that it may not be my ISP, and also may not be yours.
(btw, all this time I've been using my Mikrotik router, not the pfSense. Though I'm waiting for my dad to go have dinner to swap everything). -
Which is why I use the term "upstream."
Nothing else out on the internet knows squat about what device you are using. That is between you and the first hop.
If a router somewhere out there is blocking your IP address, it would not matter if it was pfSense or the mikrotik connected at your end.
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM)
