Port Forwarding
-
@akuma1x Hi Jeff thanks for the suggestion. Unfortunately, port 22 also won't open. I have been trying 3389 as well but to no avail. Do you think it could be the ISP possibly?
-
@no_jah said in Port Forwarding:
CG-NAT IP
- We have tried multiple ports and can't seem to get any to open.
- It is possible that we are getting a CG NAT IP I will contact my ISP for that.
-
To find out if you got public IP or CG-NAT IP, all you need to d i s to got to whatsmyip.org to see if that IP is the sam as the pfSense WAN IP.
If they are the same IP you got public IP, if not you don't have publlic IP. -
@no_jah Just checked and they are the same
-
Ok, are you on the inside of the router (LAN) when you are testing the port forward, or do you com from the outside?
-
I can connect to the server from the internal IP from the LAN then I connect to a hotspot to test the WAN connection
-
Yes, but what I mean is if you have tested to connect any of the forwarded port when you are not physically on the inside of the pfSense machine (LAN), becaus the you also need to make sure NAT-reflection is set up and working.
For me Nat reflection only works if I select NAT + Proxy mode.
-
@no_jah oh I see sorry, yes I have used a different device. I did change the NAT reflection but this also didn't work.
-
Did you change to NAT + Proxy at System / Advanced, or at the NAT rule?
I recommend you set it at Systen / Anvanced, and then select Use system default at the NAT rule? -
@no_jah Ive gone ahead and set that but still no luck. Its weird ive never had this issue, Ive got a plex server set up at home fine through FTP
-
When I compare my port forward with the images you atatched I see a couple differences
- On port forward page I have WAN address instead of WAN net as Destination
- On the FW rule page I have any instead of WAN net as Source
-
Source of wan net would only allow IP from the wan net, ie the transit network that connects you to your ISP.. that is NOT the internet.
Also dest should be your wan address...
-
@no_jah I did in fact make these changes previously and didn't update the reference photos so these are the updated photos
-
Just to really be sure you connect from the outside, try to use:
https://www.yougetsignal.com/tools/open-ports/There you enter your wan IP if it's not already picked up, and enter the port you want to check
-
@no_jah Just tried that
-
please post your wan rules and screenshot of your port forwards.
This is drop dead simple to do.. Follow the guide and you will find your issue within a couple of minutes.
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html
First thing to do if you feel your rules are correct is actually validate the traffic hits your WAN... Its impossible for pfsense to forward something it never gets. If pfsense gets it, then sniff on your lan interface of pfsense - does it send on... If so then problem is in your network or the host your sending it too.. Wrong host? Host firewall.. Host not even listening for that service, etc..
-
@johnpoz Theres the rule. Thanks for the article ill take a look now
-
NO post up your wan Rules!! And your port forwards page..
Example - here is mine
For all we know you have a rule above the rule that allows the nat blocking.. Say pfblocker rules for example... Rules are evaluated top down, first rule to trigger wins, no other rules evaluated. So we need to see rules on WAN so can tell if there is something that would block the auto rule that gets created for your nat, etc.
-
-
Wow you actually see hits on your Bogon Rules? See that 636 B... Curious wtf that is... Also have hits on your block rfc1918 rules..
I see some hits on your 21 firewall rule... So I would think traffic is getting to your wan... So do a packet captures and validate being sent to your host... You should see the SYN to port 21, if you go to can you see me . org, etc.
