PFSENSE randomely blocking ports....
-
@derelict Hi, nope no Snort installed (I do use Squid and Squidguard).
-
What rules you setting up this would not be a NAT this would be a simple firewall run on your openvpn interface, which I believe defaults to any any..
-
@johnpoz Hi, ok yes that would be true but I had to open up the SMTP server to a smart phone user as well...and THAT'S why I have the rules to limit any random hits on the server. Sorry if I left that out.
MP
-
If you turn off the NATting and FW rules for the tunnel and just leave the routing in place, does it work? I am a big fan of configuring the most basic requirements to establish communications, test, and then add complexity after each validated test.
Upgrading to the most current pfSense release may help (always a good idea, you are a few versions behind).
-
I'm not even sure how you could use a NAT rule here without breaking something. Can we see a picture of these rules?
Steve
-
@stephenw10 Hi, Here is one that gets messed up:
I have another machine that does not have these problems, same setup, but different subnet machine to the 1.x smtp server.
Starting to wonder if its somehow the printer goofing up. I'm looking into getting its logs right now. It works, then stops. I found that the only fix was to reboot the 1.x subnet PFsense box. Other reboots of printer or remote PFS did nothing.
I am going to run the PFS update just to be sure.Thx for the help you guys,
MP
-
Yeah sorry but that rule has ZERO to do with access through your vpn tunnel -- ZERO!!!
-
@johnpoz Humm...I must say I'm feeling a bit dumb....so then how are the packets handled across sub nets? One of my biggest headaches with VPN's was getting them to work across sub nets. Maybe that was my pre netbios days...
I will kill those and see what happens but I SWEAR I could not get this working at all without them.
Thx!
-
@mrpushner said in PFSENSE randomely blocking ports....:
so then how are the packets handled across subnets?
Simple... firewall rules on the originating subnet (network) pointing to the other subnet. Or, in pfsense talk - Source = originating subnet, Destination = the other subnet you want to pass the traffic to.
Jeff
-
@akuma1x Hi, yes And I can see those plainly in the VPN setup...I just have a mental block from my old VPN days, when it was not easy to get sub nets to "talk" over VPN. Thanks.
-
Mmm, it's OpenVPN it should just route between the ends like any other subnet.
The only possible way I could see that doing anything is if you have NAT reflection enabled (on that rule or globally) and the printer in trying to hit port 587 on the public WAN IP.
In that situation it would be reflected back to the mail server over the tunnel. But that would be a misconfiguration on the printer.Steve
