Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    opening ports on firewall

    Scheduled Pinned Locked Moved Firewalling
    38 Posts 7 Posters 5.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      That does not guarantee that something upstream is not responding on your behalf.

      The only way to be 100% sure the traffic is arriving on your WAN is to packet capture on your WAN. If it does not arrive there, pfSense cannot forward it.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM @johnpoz
        last edited by

        @johnpoz I tend to do it the other way around because in my experience, the traffic almost always gets to WAN. The problem is usually with the NAT itself or some other PEBKAC thing.

        1 Reply Last reply Reply Quote 0
        • R
          richardlhughes
          last edited by

          Wan Rules

          f4a5d494-681b-47c7-bbdd-bd4fa323656e-image.png

          NAT Rules

          bdc03aec-344d-43fa-ae5e-bf4f8a4d29b2-image.png

          HAPROXY (I've tried http and tcp for port 80 and cannot get port 80 open)

          9cb367d8-eb99-416a-ae6d-ba5cf95d1269-image.png

          1 Reply Last reply Reply Quote 0
          • R
            richardlhughes @Derelict
            last edited by

            @Derelict I have checked this list a couple times now. Didn't see anything standing out.

            1 Reply Last reply Reply Quote 0
            • A
              akuma1x
              last edited by akuma1x

              Alright, your NAT rules look correct, might want to make the protocol both TCP/UDP, and not just TCP.

              Your WAN rules are incorrect. Your FIRST set of 443 and 80 allow traffic to just your firewall, not another LAN machine. If you move these two new bottom rules to the very TOP of your firewall rule list, the traffic should move like you are expecting/hoping.

              Firewall rules are evaluated top down, first to match wins. That's why nothing is hitting 10.0.0.5, 80 and 443 are bouncing around inside the firewall itself, due to the first 2 top rules.

              Jeff

              DerelictD R 2 Replies Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                I don't know what didn't see anything standing out means. Did you see the SYN arrive or not?

                If you packet capture on WAN for port 32900 and test from the outside, you should see the SYN packet arrive.

                If you see it, then move your capture to the inside interface for port 32400, you should see the SYN packet sent to 10.0.0.37.

                If there is no response, look at the server (10.0.0.37) and see why.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                R 1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate @akuma1x
                  last edited by Derelict

                  @akuma1x said in opening ports on firewall:

                  Alright, your NAT rules look correct, might want to make the protocol both TCP/UDP, and not just TCP.

                  Pet peeve of mine. You shouldn't just randomly forward traffic. You should know if you need TCP, UDP, or both and forward what is required.

                  If he pcaps filtering on just the port, it will show both.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 1
                  • R
                    richardlhughes @Derelict
                    last edited by

                    @Derelict I didn't do the packet capture on the WAN, the troubleshooting list.

                    How do I setup packet capturing on the WAN? is this something I can setup on my pfsense machine or what is the best method?

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      diagnostic menu, packet capture.. put in the port your wanting to check, wan and click start... Then send the test traffic to that port.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by Derelict

                        Diagnostics > Packet Capture:

                        Interface: WAN
                        Port: 32900

                        Start, Test, Stop, Evaluate.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • R
                          richardlhughes @akuma1x
                          last edited by

                          @akuma1x said in opening ports on firewall:

                          Alright, your NAT rules look correct, might want to make the protocol both TCP/UDP, and not just TCP.

                          Your WAN rules are incorrect. Your FIRST set of 443 and 80 allow traffic to just your firewall, not another LAN machine. If you move these two new bottom rules to the very TOP of your firewall rule list, the traffic should move like you are expecting/hoping.

                          Firewall rules are evaluated top down, first to match wins. That's why nothing is hitting 10.0.0.5, 80 and 443 are bouncing around inside the firewall itself, due to the first 2 top rules.

                          Jeff

                          Using the HA Proxy and not NAT the machine directly I don't think I need the firewall rule to the web server directly on the WAN. I have the NAT for port 80 and 443 disabled along with those firewall rules. I can put 2 new rules to wan to the webserver and see if that works.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Using HAproxy is a completely different thing. In that case you would need rules passing traffic to the frontend(s).

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              And we still don't have a 30 second sniff of wan..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • chpalmerC
                                chpalmer
                                last edited by chpalmer

                                The first two WAN rules should probably be "WAN Address" instead of "This Firewall".

                                Just a guess.

                                Triggering snowflakes one by one..
                                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  richardlhughes
                                  last edited by

                                  I have the wan packets capture what do you wan me to post here?

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by Derelict

                                    Just enough to show the traffic is hitting WAN.

                                    If it is, then a pcap for the proper traffic on LAN.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      richardlhughes
                                      last edited by

                                      Does this satisfy the wan is seeing port 80. My WAN IP is x.x.176.180

                                      db03b74f-a2df-4999-8fc0-2c1afe8f79ae-image.png

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by Derelict

                                        No. That's an outbound connection from your WAN address.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          Its not that hard dude..

                                          Can you see me .org

                                          80towan.png

                                          It shows closed because I don't have anything listening or forwarded.. But you can see the traffic gets there.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            richardlhughes
                                            last edited by

                                            I am not seeing packets on port 80.

                                            Looks like my isp is blocking or something else is blocking unless I am missing something else.

                                            I have my cable modem plugged directly into my vmware server that is hosting the pfsense vm.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.