Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    opening ports on firewall

    Scheduled Pinned Locked Moved Firewalling
    38 Posts 7 Posters 5.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Using HAproxy is a completely different thing. In that case you would need rules passing traffic to the frontend(s).

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        And we still don't have a 30 second sniff of wan..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • chpalmerC
          chpalmer
          last edited by chpalmer

          The first two WAN rules should probably be "WAN Address" instead of "This Firewall".

          Just a guess.

          Triggering snowflakes one by one..
          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

          1 Reply Last reply Reply Quote 0
          • R
            richardlhughes
            last edited by

            I have the wan packets capture what do you wan me to post here?

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by Derelict

              Just enough to show the traffic is hitting WAN.

              If it is, then a pcap for the proper traffic on LAN.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • R
                richardlhughes
                last edited by

                Does this satisfy the wan is seeing port 80. My WAN IP is x.x.176.180

                db03b74f-a2df-4999-8fc0-2c1afe8f79ae-image.png

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by Derelict

                  No. That's an outbound connection from your WAN address.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    Its not that hard dude..

                    Can you see me .org

                    80towan.png

                    It shows closed because I don't have anything listening or forwarded.. But you can see the traffic gets there.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • R
                      richardlhughes
                      last edited by

                      I am not seeing packets on port 80.

                      Looks like my isp is blocking or something else is blocking unless I am missing something else.

                      I have my cable modem plugged directly into my vmware server that is hosting the pfsense vm.

                      1 Reply Last reply Reply Quote 0
                      • R
                        richardlhughes
                        last edited by

                        Just off the phone with suddenlink. Residential accounts are not able to open port 80. The same level of service for a business account for the same 1Gbps account is approximately 3x the cost. That is not reasonable.

                        1 Reply Last reply Reply Quote 0
                        • chpalmerC
                          chpalmer
                          last edited by

                          What is the model of your cable modem? It is in bridge mode.. Correct?

                          Triggering snowflakes one by one..
                          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                          R 1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Quick google search says suddenlink pretty much sucks for this. Sorry.

                            That's why we pcap. Nothing like making sure the traffic is actually on the wire before proceeding with additional troubleshooting.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • R
                              richardlhughes @chpalmer
                              last edited by

                              @chpalmer

                              Here is the version of modem I have.

                              ARRIS DOCSIS 3.0 Touchstone WideBand Cable Modem
                              HW_REV: 3
                              VENDOR: ARRIS Group, Inc.
                              BOOTR: 2.2.0.45
                              SW_REV: 9.1.103S
                              MODEL: CM3200A

                              chpalmerC 1 Reply Last reply Reply Quote 0
                              • chpalmerC
                                chpalmer @richardlhughes
                                last edited by

                                @richardlhughes said in opening ports on firewall:

                                @chpalmer

                                Here is the version of modem I have.

                                ARRIS DOCSIS 3.0 Touchstone WideBand Cable Modem
                                MODEL: CM3200A

                                I didn't catch your post right before I asked. Can you use port 88 instead?

                                Triggering snowflakes one by one..
                                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  richardlhughes
                                  last edited by

                                  I just need to figure out the SSL certs at this point with cloudflare service. I am not sure if I can use the acme service or not. I am hoping I can make it auto renew if needed. Does it make sense to use ssl offloading or just ssl on the front end?

                                  I am also looking at moving my open vpn to the HAProxy on 443.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.