[Solved] I'm apparently unable to port forward...
-
Not so much what the mac is - but he gets an IP in a completely different netblock.. 2 different /24 not even in the same parent..
-
Right. That should be sorted out with the ISP using the new MAC address. Then there isn't some MAC spoofing hack in the network.
-
Agree any IP he gets from his ISP should work... But would be a simple test to see if it works when he uses the same IP.. Which is info he can take to the ISP.. This IP works - this IP doesn't.. Which he could do now - but I still think he thinks it has something to do with pfsense. Getting pfsense to work when it has the same IP would prove to him its upstream from him and not pfsense.
-
right.
Certainly doesn't cost anything to try it but if it does fix the problem I would pursue getting it working with the native MAC address.
I just don't like long-term bandages on my networks. You never know when, for instance, your particular mix of "extra" things that nobody else has will fail on an upgrade, etc.
MAC addresses change. ISPs need to deal with it.
-
Ok, just an update. I got the pfSense box running with the spoofed mac, and indeed, I got a public IP on the same block.. (though not exactly the same address.. the last part changed).
I'm gonna take my time now to do everything I can to get this thing working already..
-
Another update.. I finally learned how to use Packet Capture, and I do receive stuff on port 8889 when I hit a scan on canyouseeme.org .
So far so good. Gonna try the damn port forwarding now.
-
Okay. I tried literally everything. Created NAT rule pointing WAN Address TCP 8889 to 192.168.10.6 TCP 80, created firewall rule to allow TCP 8889 from WAN, and I could even see something on the State tables!
-
@ninom4ster said in I'm apparently unable to port forward...:
So, are you guys still convinced that the problem isn't pfSense...?
Yes.
-
Filter those states on the canyouseeme.org address so you also pick up the LAN state. (That WAN state is proof the port forward is working since the destination was translated).
Do the same thing and packet capture on the 192.168.10.0 interface for traffic to host 192.168.10.6 TCP port 80. What do you see there?
You're really close to getting this fixed.
-
This post is deleted! -
It is almost certainly something on this list:
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html
It's invariably something on that list.
-
Nothing...
-
What about the states?
-
Nothing on LAN...
-
Learn this lesson, kids:
Even if your server's firewall (ufw, iptables) HAS a rule which allows traffic on the FUCKING PORT you're trying to forward, disable that stupid thing anyways, even if you're sure that it's not the problem, because today I learned by pain that nothing is what it looks like!
Thank you, and have a good night.
-
iptables
Curious though. How is it that you swore it worked with the mikrotik and not pfSense? The server firewall should not care.
-
I know as much as you do....
btw, it was UFW... GUFW to be more precise...
-
@Derelict can you please answer my PM? it's very important. Thank you.
-
So once again after long fought battle of user swearing its pfsense its PEBKAC....
And could of found where the the issue was exactly in a few minutes if user had gone through the troubleshooting guide and just asked questions on any specifics they didn't actually understand on how to do.. Like packet capture/sniff, etc.
I don't see how a host firewall had anything to do with which router was being used? Lets hope we get some more info..
-
@johnpoz said in [Solved] I'm apparently unable to port forward...:
I don't see how a host firewall had anything to do with which router was being used? Lets hope we get some more info..
I don't use (G)UFW, but it possibly identifies networks based on the gateway MAC (similar to Windows) and then applies a different rule-set.
