Port Forwarding

[no_jah]

@roryahanan

When I compare my port forward with the images you atatched I see a couple differences

1. On port forward page I have WAN address instead of WAN net as Destination
2. On the FW rule page I have any instead of WAN net as Source

[johnpoz]

Source of wan net would only allow IP from the wan net, ie the transit network that connects you to your ISP.. that is NOT the internet.

Also dest should be your wan address...

[roryahanan]

@no_jah I did in fact make these changes previously and didn't update the reference photos so these are the updated photos

[no_jah]

@roryahanan

Just to really be sure you connect from the outside, try to use:
https://www.yougetsignal.com/tools/open-ports/

There you enter your wan IP if it's not already picked up, and enter the port you want to check

[roryahanan]

@no_jah Just tried that

[johnpoz]

please post your wan rules and screenshot of your port forwards.

This is drop dead simple to do.. Follow the guide and you will find your issue within a couple of minutes.

https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html

First thing to do if you feel your rules are correct is actually validate the traffic hits your WAN... Its impossible for pfsense to forward something it never gets. If pfsense gets it, then sniff on your lan interface of pfsense - does it send on... If so then problem is in your network or the host your sending it too.. Wrong host? Host firewall.. Host not even listening for that service, etc..

[roryahanan]

@johnpoz Theres the rule. Thanks for the article ill take a look now

[johnpoz]

NO post up your wan Rules!! And your port forwards page..

Example - here is mine

For all we know you have a rule above the rule that allows the nat blocking.. Say pfblocker rules for example... Rules are evaluated top down, first rule to trigger wins, no other rules evaluated. So we need to see rules on WAN so can tell if there is something that would block the auto rule that gets created for your nat, etc.

[roryahanan]

@johnpoz

[johnpoz]

Wow you actually see hits on your Bogon Rules? See that 636 B... Curious wtf that is... Also have hits on your block rfc1918 rules..

I see some hits on your 21 firewall rule... So I would think traffic is getting to your wan... So do a packet captures and validate being sent to your host... You should see the SYN to port 21, if you go to can you see me . org, etc.

[no_jah]

Could it be that the internal IP of your FTP-server has changed since you set up the port forward?

[roryahanan]

@no_jah I checked that earlier just incase

[no_jah]

@roryahanan

And no Firewall software blocking incoming connections on the FTP-server computer?

[johnpoz]

Do your sniff, diag packet capture on your lan interface... Do you see the syn to your ftp server private IP... If you do not see an answer its not pfsense that is your problem.

Here I just setup a port forward for ftp (21) and can you see me shows closed..

See how my client on 192.168.2.11 sent a RST... Basically he said to F off ;)