NAT not opening on custom Ports
-
16:58:20.698354 90:e2:ba:06:47:19 > 00:15:5d:00:39:0a, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 53, id 34225, offset 0, flags [DF], proto TCP (6), length 60) 198.199.98.246.45870 > 192.168.1.5.7777: Flags [S], cksum 0xe15e (correct), seq 3692619266, win 14600, options [mss 1460,sackOK,TS val 1255039923 ecr 0,nop,wscale 8], length 0 16:58:21.695091 90:e2:ba:06:47:19 > 00:15:5d:00:39:0a, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 53, id 34226, offset 0, flags [DF], proto TCP (6), length 60) 198.199.98.246.45870 > 192.168.1.5.7777: Flags [S], cksum 0xe064 (correct), seq 3692619266, win 14600, options [mss 1460,sackOK,TS val 1255040173 ecr 0,nop,wscale 8], length 0 16:58:21.696346 90:e2:ba:06:47:19 > 00:15:5d:00:39:0a, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 55, id 59506, offset 0, flags [DF], proto TCP (6), length 60) 198.199.98.246.45875 > 192.168.1.5.7777: Flags [S], cksum 0xc983 (correct), seq 1276808412, win 14600, options [mss 1460,sackOK,TS val 1255040174 ecr 0,nop,wscale 8], length 0 16:58:22.696119 90:e2:ba:06:47:19 > 00:15:5d:00:39:0a, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 55, id 59507, offset 0, flags [DF], proto TCP (6), length 60) 198.199.98.246.45875 > 192.168.1.5.7777: Flags [S], cksum 0xc889 (correct), seq 1276808412, win 14600, options [mss 1460,sackOK,TS val 1255040424 ecr 0,nop,wscale 8], length 0 16:58:22.697832 90:e2:ba:06:47:19 > 00:15:5d:00:39:0a, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 55, id 10376, offset 0, flags [DF], proto TCP (6), length 60) 198.199.98.246.45880 > 192.168.1.5.7777: Flags [S], cksum 0x7016 (correct), seq 3829681440, win 14600, options [mss 1460,sackOK,TS val 1255040424 ecr 0,nop,wscale 8], length 0 16:58:23.696111 90:e2:ba:06:47:19 > 00:15:5d:00:39:0a, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 55, id 10377, offset 0, flags [DF], proto TCP (6), length 60) 198.199.98.246.45880 > 192.168.1.5.7777: Flags [S], cksum 0x6f1c (correct), seq 3829681440, win 14600, options [mss 1460,sackOK,TS val 1255040674 ecr 0,nop,wscale 8], length 0 -
also
17:10:45.632826 IP 192.168.1.1.32454 > 192.168.1.5.7777: tcp 0 17:10:48.646663 IP 192.168.1.1.32454 > 192.168.1.5.7777: tcp 0 17:10:51.915662 IP 192.168.1.1.32454 > 192.168.1.5.7777: tcp 0 17:10:55.162909 IP 192.168.1.1.32454 > 192.168.1.5.7777: tcp 0 -
OK so 192.168.1.5 isn't responding.
-
@derelict I don't get it, the firewall is off... 1.5 is the VM running via hyper V
-
All we can see is the SYN packets are sent to 192.168.1.5 port 7777 and there is no response. It's something in either your infrastructure or on that host itself. It's not the firewall. The firewall is forwarding the traffic as instructed.
-
@derelict Thing about it is, it works perfectly find on a normal router (Zyxel), nothings changed on the server itself... ?
-
Well, the SYN is sent and there is no response. Nothing to do with the firewall there.
Check (really check) everything here:
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html
-
Is this a windows VM? If yes it probably detected that the MAC of the default gateway changed and switched the network type to public which then turns parts of the firewall back on. So really check your stuff.
-
^ exacltly! router 1 with mac xyz.. firewall set to private or turned off... Router 2 (pfsense) put in place new mac ABC... windows says oh better default to public network firewall ON..
Here is the thing... you sent SYN to mac xyz... Why your host doesn't answer has zero to do with pfsense..
Only thing you can do on pfsense here is validate that mac xyz is actually your machine your wanting to send too.. If correct mac, then the problem is somewhere on the wire between pfsense and the host.. Pfsense did its job, it put the traffic on the wire.. Pfsense as nothing to do until it sees the return traffic.
This is the part that gets frustrating
I followed it before hand.
Clearly you didn't because if you did you would have already done this sniff and found that pfsense sent the traffic on and the box didn't answer..
-
@johnpoz I get the frustration BUT
I have done EXACTLY what i did to get my server RDP working. and it works! Did it with my main pc IT WORKS, I followed the exact same steps. I even made allowances in the windows firewall. Followed the exact same steps results? Connection failed.
Solve that one real quick -_-; because I stripped my entire network apart and put it back together piece by piece and yet I yeild the same results!? So believe me when I say The Frustration is mutual
Heres the funny part too. I did it to my machine WHICH i know replies and guess what... CONNECTION FAILED. I'm one firewall short of flipping a table here
-
All pfSense can do is forward the traffic. That there is no response is because something inside is configured incorrectly for the task you desire it to perform..
I don't get what is so difficult to understand about that. How is something on the firewall supposed to conjur up a response from the target host?
What would you have us do for you?
-
Lets explain it a bit simpler for you..
Billy - Kevin - Susan
Billy ask Kevin to say Hello to Susan...
Kevin ---> Hey Susan Billy Says Hello!!!
Susan = NOTHING!!!
Billy can scream all day at Kevin.. Billy can Hit Kevin about the Head with his fists and get all upset at Kevin... But there is NOTHING Kevin can do if Susan doesn't answer...
What do you not understand here???
Pfsense sent the SYN, if you do not get an answer there is NOTHING pfsense can do about that.. It did what it was told.. It sent the syn to the IP you told it to send it too.. It does that via arping for the IP and putting the traffic on the wire with that mac on it...
-
-
There is no guide for troubleshooting your network... You have already determined the problem is NOT pfsense... Pfsense sends the SYN..
So you need to figure out why its either not getting to the client??
Wrong IP, Wrong mac? VMware blocking it?Or why the client is not answering?
Not actually listening on the PORT? It is running a firewall? And the application never gets the SYN? Its using some other default gateway or some other routing sending source IP to some other location?Is the client even ON?
I would suggest you for starters actually validate that the box is even listening on that port.. simple netstat -an for example... Sniff on the box does it every see the SYN?? Does it actually answer but sending it some where else?
-
@johnpoz said in NAT not opening on custom Ports:
There is no guide for troubleshooting your network... You have already determined the problem is NOT pfsense... Pfsense sends the SYN..
So you need to figure out why its either not getting to the client??
Wrong IP, Wrong mac? VMware blocking it?Or why the client is not answering?
Not actually listening on the PORT? It is running a firewall? And the application never gets the SYN? Its using some other default gateway or some other routing sending source IP to some other location?Is the client even ON?
I would suggest you for starters actually validate that the box is even listening on that port.. simple netstat -an for example... Sniff on the box does it every see the SYN?? Does it actually answer but sending it some where else?
deletes the VM and starts again
I doubt this is problem but I did install the N version of PRO. So I'm reinstalling regular pro.
-
Yeah that has NOTHING to do with your problem.. Doesn't matter if it was windows 95, 98, nt, 2k, xp, 7, 8, 10 - doesnt freaking matter what OS was running to validate basic networking..
So did you validate its listening with netstat -an
Did you validate pfsense was actually sending to the correct mac address of the machine with the IP address?
Did you sniff on the machine to see if the syn was getting there or not?
The only thing we are sure of was that pfsense put a syn on the wire to IP address xyz.. But was that actually the IP of the machine listening..
That you could not even ping the IP from pfsense IP on the same network screams of firewall!! Be it on the host, or the VM host running the VM.. For we know the VM was behind a NAT you setup on your VM host, etc.
-
@johnpoz said in NAT not opening on custom Ports:
Yeah that has NOTHING to do with your problem.. Doesn't matter if it was windows 95, 98, nt, 2k, xp, 7, 8, 10 - doesnt freaking matter what OS was running to validate basic networking..
So did you validate its listening with netstat -an
Did you validate pfsense was actually sending to the correct mac address of the machine with the IP address?
Did you sniff on the machine to see if the syn was getting there or not?
The only thing we are sure of was that pfsense put a syn on the wire to IP address xyz.. But was that actually the IP of the machine listening..
That you could not even ping the IP from pfsense IP on the same network screams of firewall!! Be it on the host, or the VM host running the VM.. For we know the VM was behind a NAT you setup on your VM host, etc.
PFSense gives it a static IP via MAC address (which i have located from the VM Itself) and therefore the PFSense talks to that machine DHCP wise. I can ping the machine via my machine. When I ran Netstats it wasn't listening to the port (However this could be the fact the software wasn't running at the time),
Both Firewalls have been allocated on the actual machines not PFSense to let those ports 7777 and 27015 through on private and public. The VM talks to my machines on the network because the game appears in my lobby under LAN only.
So local machines screaming at the server and the server screams back. outside of that its screams and its like a tree falling in the forest
-
Does the device have a gateway.. It can not talk outside of local network without a gateway.
Do a port test from the pfsense interface in that network.
-
PFSense says connection refused. i've tested the source from WAN, Network all options, all I get is refused.
The device has a gateway of 192.168.1.1 (PFSENSE)
Outside of that there is no other device. it basically got Openreach Modem -> NIC1 (PFSense WAN) then it goes NIC2 (LAN DHCP) -> 8 Port Unmanaged Switch
-
Posted in wrong thread
