[Solved] I'm apparently unable to port forward...

johnpoz

Look at this NONSENSE tracing to you..

>tracert -d 201.162.x.x

Tracing route to 201.162.x.x over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.9.253
  2    10 ms    11 ms    11 ms  50.4.132.1
  3     9 ms     9 ms     9 ms  76.73.191.106
  4    31 ms    11 ms     9 ms  76.73.164.121
  5    10 ms    12 ms    11 ms  76.73.191.140
  6    12 ms    12 ms    12 ms  76.73.164.105
  7    10 ms    10 ms    19 ms  76.73.164.65
  8    20 ms    11 ms    23 ms  76.73.191.224
  9    19 ms    11 ms    15 ms  75.76.35.10
 10    32 ms    35 ms    32 ms  75.76.84.231
 11    31 ms    32 ms    32 ms  75.76.35.105
 12   154 ms   155 ms   156 ms  198.32.160.236
 13   157 ms   161 ms   156 ms  200.150.1.169
 14   155 ms   155 ms   158 ms  200.150.10.1
 15   176 ms   173 ms   173 ms  177.126.100.153
 16   175 ms   174 ms   177 ms  10.0.20.190

16 175 ms 174 ms 177 ms 10.0.20.190

Derelict

Not quite sure how you got those responses at all there.

johnpoz

Yeah I don't either clearly something WAY wrong there.. Should be impossible to get such an answer.

Derelict

I suppose it's possible that nobody along the path is filtering for that.

NinoM4ster

@Derelict :

So your ISP is forwarding outbound connections from you but dropping inbound connections.

That's not totally true.. my friend from a city far away can ping me with no problems. And also, I can't ping John's address either, so I guess the problem is up higher... I can get past Algar which I guess is my ISP's route, and John can get up to Algar in the opposite way..

I really don't freaking know what's happening, but I've seen it before.. A few months ago I tried to, but I couldn't access a website my friend from the US was hosting at his place, and he narrowed it down to be a Comcast router blocking incoming traffic from me (I'm in Brazil).

So, what I meant with all this is that it may not be my ISP, and also may not be yours.
(btw, all this time I've been using my Mikrotik router, not the pfSense. Though I'm waiting for my dad to go have dinner to swap everything).

Derelict

Which is why I use the term "upstream."

Nothing else out on the internet knows squat about what device you are using. That is between you and the first hop.

If a router somewhere out there is blocking your IP address, it would not matter if it was pfSense or the mikrotik connected at your end.

NinoM4ster

@johnpoz :

(...) clearly something WAY wrong there..

Indeed. I have no doubt that my ISP isn't capable of doing things right..

NinoM4ster

@derelict I'm fully aware of that. I was just mentioning.

johnpoz

So if your IP your current router works for routing... Then have pfsense use the same mac so it gets the same IP and you should be fine.

Also it would be your ISP job to troubleshoot why your IP can not get to another IP, or why some IPs can not get to your IPs... They are the ones that advertise their routes, etc. If there is something wrong upstream for their networks then they are the ones that need to work out the problem... Not the end user.

Derelict

My recommendation is to solve the issue with the other gear/MAC and the ISP before resorting to things like MAC spoofing. To me that stuff should be a last resort. Certainly doesn't cost anything to try it but if it does fix the problem I would pursue getting it working with the native MAC address.

(If that is actually the problem which is becoming less and less clear with every post)

johnpoz

Not so much what the mac is - but he gets an IP in a completely different netblock.. 2 different /24 not even in the same parent..

Derelict

Right. That should be sorted out with the ISP using the new MAC address. Then there isn't some MAC spoofing hack in the network.

johnpoz

Agree any IP he gets from his ISP should work... But would be a simple test to see if it works when he uses the same IP.. Which is info he can take to the ISP.. This IP works - this IP doesn't.. Which he could do now - but I still think he thinks it has something to do with pfsense. Getting pfsense to work when it has the same IP would prove to him its upstream from him and not pfsense.

Derelict

right.

Certainly doesn't cost anything to try it but if it does fix the problem I would pursue getting it working with the native MAC address.

I just don't like long-term bandages on my networks. You never know when, for instance, your particular mix of "extra" things that nobody else has will fail on an upgrade, etc.

MAC addresses change. ISPs need to deal with it.

NinoM4ster

Ok, just an update. I got the pfSense box running with the spoofed mac, and indeed, I got a public IP on the same block.. (though not exactly the same address.. the last part changed).

alt text

I'm gonna take my time now to do everything I can to get this thing working already..

NinoM4ster

Another update.. I finally learned how to use Packet Capture, and I do receive stuff on port 8889 when I hit a scan on canyouseeme.org .

alt text

So far so good. Gonna try the damn port forwarding now.

NinoM4ster

Okay. I tried literally everything. Created NAT rule pointing WAN Address TCP 8889 to 192.168.10.6 TCP 80, created firewall rule to allow TCP 8889 from WAN, and I could even see something on the State tables!
alt text

Grimson

@ninom4ster said in I'm apparently unable to port forward...:

So, are you guys still convinced that the problem isn't pfSense...?

Yes.

Derelict

Filter those states on the canyouseeme.org address so you also pick up the LAN state. (That WAN state is proof the port forward is working since the destination was translated).

Do the same thing and packet capture on the 192.168.10.0 interface for traffic to host 192.168.10.6 TCP port 80. What do you see there?

You're really close to getting this fixed.

NinoM4ster

This post is deleted!