[Solved] I'm apparently unable to port forward...
-
Another update.. I finally learned how to use Packet Capture, and I do receive stuff on port 8889 when I hit a scan on canyouseeme.org .
So far so good. Gonna try the damn port forwarding now.
-
Okay. I tried literally everything. Created NAT rule pointing WAN Address TCP 8889 to 192.168.10.6 TCP 80, created firewall rule to allow TCP 8889 from WAN, and I could even see something on the State tables!
-
@ninom4ster said in I'm apparently unable to port forward...:
So, are you guys still convinced that the problem isn't pfSense...?
Yes.
-
Filter those states on the canyouseeme.org address so you also pick up the LAN state. (That WAN state is proof the port forward is working since the destination was translated).
Do the same thing and packet capture on the 192.168.10.0 interface for traffic to host 192.168.10.6 TCP port 80. What do you see there?
You're really close to getting this fixed.
-
This post is deleted! -
It is almost certainly something on this list:
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html
It's invariably something on that list.
-
Nothing...
-
What about the states?
-
Nothing on LAN...
-
Learn this lesson, kids:
Even if your server's firewall (ufw, iptables) HAS a rule which allows traffic on the FUCKING PORT you're trying to forward, disable that stupid thing anyways, even if you're sure that it's not the problem, because today I learned by pain that nothing is what it looks like!
Thank you, and have a good night.
-
iptables
Curious though. How is it that you swore it worked with the mikrotik and not pfSense? The server firewall should not care.
-
I know as much as you do....
btw, it was UFW... GUFW to be more precise...
-
@Derelict can you please answer my PM? it's very important. Thank you.
-
So once again after long fought battle of user swearing its pfsense its PEBKAC....
And could of found where the the issue was exactly in a few minutes if user had gone through the troubleshooting guide and just asked questions on any specifics they didn't actually understand on how to do.. Like packet capture/sniff, etc.
I don't see how a host firewall had anything to do with which router was being used? Lets hope we get some more info..
-
@johnpoz said in [Solved] I'm apparently unable to port forward...:
I don't see how a host firewall had anything to do with which router was being used? Lets hope we get some more info..
I don't use (G)UFW, but it possibly identifies networks based on the gateway MAC (similar to Windows) and then applies a different rule-set.
-
Ah -- great insight @Grimson makes a lot of sense... Just like windows can set a network as public and shutdown all inbound when the gateway mac changes.. Possible explanation for sure.
Not being able to ping his public could of just been misconfigured pfsense rules? Lets hope he wants to do some more investigation.. So we are sure he understand how to configure rules, etc.
He did post a icmp rule on his wan that should of allowed ping.. But maybe there was something in his floating? Or something else weird going on - the 1 trace to him was showing a 10 address in the path. And in that pic he posted with the icmp rule also had hits on his rfc1918 and bogon rules.. but no hits on the icmp rule, etc.
-
This post is deleted! -
I did just now.. With my thoughts on the matter. I will have to discuss with other mods. But please take into account others time and effort, etc.
-
So... I'm curious. What did the solution turn out to be? I don't see it clearly called out in the many messages above.
Jeff
-
Looks like he wants everything deleted -- what we assume is some misconfig on his boxes firewall he was trying to forward too.
Grimson's guess is that this firewall like windows firewall has some method of changing profiles based upon network information. Kind of like windows can switch between private and public profiles. While this does seem logical - the OP seems to want to just forget the whole thing.. Even though the information could be very informative to others in the same boat with problems in forwarding.
Not exactly sure what exact OS or firewall he was running - so makes it difficult to investigate further. Wish the OP would change their minds and continue down the path to enlightenment for just not the people involved closure but everyone else that might come across this thread. Like yourself.
I will look into further when I get a chance - and reread the troubleshooting guide. Since mention of firewall profiles and rule sets that could change upon network changes - like say the mac address of the gateway changing is for sure a good troubleshooting tip to finding a users problem.
