[Solved] I'm apparently unable to port forward...

NinoM4ster

I understand enough about NAT. It is indeed exposed externally, since the WAN does get an external address. I know what I'm doing.

I just noticed that I got something wrong when I tried using the Packet Capture.. I was really tired and for some reason I thought it generated traffic itself, somehow.. (don't blame me, it was 3 in the morning..) so that's probably why it was blank..

I might try again another day.. Unfortunately I can't simply shutdown everything (to swap the devices) since my dad uses the Internet constantly for wotk..

Cheers.

johnpoz

So what is your public IP now - PM it to me.. And validate that it answers ping.. And if the port forward works, etc.

Cuz the IP you sent me still is not answering ping.. So whats the IP when you use this other router..

NinoM4ster

Sent.

And btw, my ISP shouldn't block unknown Mac, or else I wouldn't have internet access at all. not even outgoing.

johnpoz

Doesn't always work that way.. Many an isp allows mac address for some access until its registered, etc. Is quite possible for you to have 1 sort of access with known mac, and then limited sort of access when you have another mac until it gets registered, etc.

Your IPs are in completely different net blocks.. So its possible traffic inbound works on netblock A, but not when using netblock B..

BTW your new IP doesn't ping either.. But I do show 8889 being open.

How come you could not ping my IP? Can you ping my IP now? I showed you when you pinged me before I that I sent a reply.. But you didn't get it, etc. Its possible maybe they have issues on the netblock you get when you install pfsense. Simple test of that would be to clone the mac address of your router so that pfsense uses the same mac on its wan.. This way you "should" get the exact same address as this router for your wan.

akuma1x

Why are most of the posts deleted in this topic? I was looking forward to following the story.

Jeff

johnpoz

The OP deleted them - you would have to ask him why he deleted them.. he had some screenshots in them. But none of which showed any personal info, etc.

If the OP wanted them deleted that is his call.

NinoM4ster

This post is deleted!

NinoM4ster

@johnpoz Yes, I was thinking about spoofing the WAN mac..

About the public address block, I also don't know how they work.. sometimes I get 186.X, sometimes 187.X, and sometimes even 201.X.. it's really weird..

~~I'll check right now if I have ICMP rule enabled here...~~ yes, I do....

~~And will also try to ping your IP (though I already did that with no success the other day)~~ Yeah, no response..

Weird thing is that I can ping your IP using this tool.

NinoM4ster

@johnpoz :

Is this your ISP?
ALGAR TELECOM S/A

Ah, sorry.. no, it's not. My ISP (ViaReal) probably use AlgarTelecom's route.

I ran a Traceroute to your IP and it stopped at eqix-dc2.wideopenwest.com [206.126.236.136]. Can you try one at my direction and send me the screenshot?

Thanks.

Derelict

So your ISP is forwarding outbound connections from you but dropping inbound connections. You'll have to ask them why that is.

johnpoz

Look at this NONSENSE tracing to you..

>tracert -d 201.162.x.x

Tracing route to 201.162.x.x over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.9.253
  2    10 ms    11 ms    11 ms  50.4.132.1
  3     9 ms     9 ms     9 ms  76.73.191.106
  4    31 ms    11 ms     9 ms  76.73.164.121
  5    10 ms    12 ms    11 ms  76.73.191.140
  6    12 ms    12 ms    12 ms  76.73.164.105
  7    10 ms    10 ms    19 ms  76.73.164.65
  8    20 ms    11 ms    23 ms  76.73.191.224
  9    19 ms    11 ms    15 ms  75.76.35.10
 10    32 ms    35 ms    32 ms  75.76.84.231
 11    31 ms    32 ms    32 ms  75.76.35.105
 12   154 ms   155 ms   156 ms  198.32.160.236
 13   157 ms   161 ms   156 ms  200.150.1.169
 14   155 ms   155 ms   158 ms  200.150.10.1
 15   176 ms   173 ms   173 ms  177.126.100.153
 16   175 ms   174 ms   177 ms  10.0.20.190

16 175 ms 174 ms 177 ms 10.0.20.190

Derelict

Not quite sure how you got those responses at all there.

johnpoz

Yeah I don't either clearly something WAY wrong there.. Should be impossible to get such an answer.

Derelict

I suppose it's possible that nobody along the path is filtering for that.

NinoM4ster

@Derelict :

So your ISP is forwarding outbound connections from you but dropping inbound connections.

That's not totally true.. my friend from a city far away can ping me with no problems. And also, I can't ping John's address either, so I guess the problem is up higher... I can get past Algar which I guess is my ISP's route, and John can get up to Algar in the opposite way..

I really don't freaking know what's happening, but I've seen it before.. A few months ago I tried to, but I couldn't access a website my friend from the US was hosting at his place, and he narrowed it down to be a Comcast router blocking incoming traffic from me (I'm in Brazil).

So, what I meant with all this is that it may not be my ISP, and also may not be yours.
(btw, all this time I've been using my Mikrotik router, not the pfSense. Though I'm waiting for my dad to go have dinner to swap everything).

Derelict

Which is why I use the term "upstream."

Nothing else out on the internet knows squat about what device you are using. That is between you and the first hop.

If a router somewhere out there is blocking your IP address, it would not matter if it was pfSense or the mikrotik connected at your end.

NinoM4ster

@johnpoz :

(...) clearly something WAY wrong there..

Indeed. I have no doubt that my ISP isn't capable of doing things right..

NinoM4ster

@derelict I'm fully aware of that. I was just mentioning.

johnpoz

So if your IP your current router works for routing... Then have pfsense use the same mac so it gets the same IP and you should be fine.

Also it would be your ISP job to troubleshoot why your IP can not get to another IP, or why some IPs can not get to your IPs... They are the ones that advertise their routes, etc. If there is something wrong upstream for their networks then they are the ones that need to work out the problem... Not the end user.

Derelict

My recommendation is to solve the issue with the other gear/MAC and the ISP before resorting to things like MAC spoofing. To me that stuff should be a last resort. Certainly doesn't cost anything to try it but if it does fix the problem I would pursue getting it working with the native MAC address.

(If that is actually the problem which is becoming less and less clear with every post)