[SOLVED]Getting kicked out from playing Overwatch

NogBadTheBad

I think you need to talk with your ISP.

Bob.Dig

@NogBadTheBad One County or one list only would be easy because I could just Invert Source and everything would be fine. Your screen looks much more complicate to me.
So what I will do now is disable all geoblocking and all of pfblocker and will look if the problem still occurs.
Thank you for now!

Bob.Dig

I think you need to talk with your ISP.

It is a big one, Germanys second or third biggest cable-provider, so no chance, they do what they do.

NogBadTheBad

@Bob-Dig said in Getting kicked out from playing Overwatch:

I could just Invert Source and everything would b

Is it Telecolumbus ?

Whoever it is they are doing something funky as your router has a different IP address to what's reported by whatsmyip.

Bob.Dig

@NogBadTheBad Yes. But this IP is "made" for this and I can open ports etc. There is nothing I can do about it and maybe it is an pfsense-only or Fancy-Firewall-only problem.

Bob.Dig

@NogBadTheBad So after disabling pfBlocker I had no problem playing Overwatch, although it might be to early to say that definitely.

Anyway, maybe all this geoblocking was to much and had unintended consequences?

So I am looking at this alias permit thingy and I don't understand it at all.
When I permit something, where is it blocked in the first place to make any sense?
I made one up but couldn't see it under rules, where is it?
Maybe you have a link which fully explains it?

Bob.Dig

After watching it more closely I think I get it, how it works. Or at least, I am getting there.
Interesting...
But it doesn't work with NAT or does it?
It does, was on the wrong tab.

Now I have to see if it is any good:

chpalmer

Your on carrier grade NAT.

NogBadTheBad

@Bob-Dig

You just need to follow the screenshots that i posted to create an alias with all the countries you want to allow through then use it in your allow alias.

The less rules / matches the firewall needs to process the better.

NogBadTheBad

@chpalmer

~~Are those carrier grade nat ip address, never come across cgn before?~~

https://chrisgrundemann.com/index.php/2012/100640010/

Also doesn’t cgn break customers doing port forwards?

Bob.Dig

You just need to follow the screenshots that i posted to create an alias with all the countries you want to allow through then use it in your allow alias.

The less rules / matches the firewall needs to process the better.

That's what I did on my last screenshot. It is a little more complicated to set up or maybe there are more easy options I don't know. Also I hope this will help with Overwatch, I still don't know for sure, because I like this game but only in small doses.

Are those carrier grade nat ip address, never come across cgn before?

Also doesn’t cgn break customers doing port forwards?

Whatever they do, I can open ports, so would be interested to know the right term for that.

PS:Still getting marked as spammer here, even without VPN, I have to remove the beginning of each quote.

@NogBadTheBad I also made some port aliases so my rules on WAN now look more clean (less rules). Again, thank you!

chpalmer

@NogBadTheBad said in Getting kicked out from playing Overwatch:

Also doesn’t cgn break customers doing port forwards?

Yep. Many people will be behind the public IP address he is behind. no way to port forward and that address is not routable from the outside. Any kind of port forward would have to be set up by the ISP you your NATt'd address.

Technically you are double NATt'd.

Id be interested to see your firewall logs..

pfblocker would be pretty useless on the WAN.

Bob.Dig

pfblocker would be pretty useless on the WAN.

Don't ask me how it works but I can instantly do port forwards by my own.

chpalmer

So you have open ports from the outside?

If for some reason your ISP was NATting every address in their system I suppose they might put you in a DMZ of sorts.. Can you do a test at GRC.com and show the results here?

https://www.grc.com/x/ne.dll?bh0bkyd2

Ive already tried a port scan and came up with nothing. You might have the US blocked so Id understand but..

Just because you can build a port forward doesn't mean anyone is getting to you. Maybe other customers behind your CGNAT..

Bob.Dig

@chpalmer Like I said before, yes I can. You can believe me or not...

And I had no more problems with overwatch after changing the geoblocking to what @NogBadTheBad has suggested.

chpalmer

@Bob-Dig said in Getting kicked out from playing Overwatch:

@chpalmer Like I said before, yes I can. You can believe me or not...

Didn't say I don't believe you.. I am saying that based on your input here.. Your WAN address is 100.65.134.66 and your public IP address shows up as 82.119.9.xxx (you still have it visible in a post above). That means you are behind some kind of NAT. Normally when you are behind CGNAT in such a way there is no way to get to you by accessing the public address you are behind. Usually the carrier has many customers showing up behind the same address. If they have somehow "port forwarded" to you we cannot possibly know that without someone coming along and telling us otherwise.

(Unless you are double NAT'd behind your own modem and failed to mention that or I missed that above.. The address your WAN shows up is pretty specific and Id not guess that you chose that.)

Since you are obviously behind CGNAT then you have to take that into account in trying to diagnose your connection problems here.

Many times a carrier will use CGNAT as a side benefit to them to keep residential service customers from hosting servers.

Bob.Dig

@chpalmer I even have a rule just for GRC, which doesn't work anymore, because now the geoblocking is in the portforwards.

And no double-NAT on my side.

Bob.Dig

@chpalmer but for your curiosity, here is a portscan from another site. And I already changed my WAN-IP-address.

JeGr

@Bob-Dig gave you a couple of so you shouldn't be hit as hard by spam detection anymore.

Still don't really get your NAT forwards or rules you made with pfBlockerNG but we could more easily discuss that in german in the other section. But a 100.x address is most probably a CGN address. And if you have that on the WAN and can port forwards ports yourself, the assumption that double NAT from the carrier itself is in play is a big possibility. As there are quite a few special nets included in the various pfBNG lists, it may very well be an update of one of the lists that locked you out of play (as some of them get updated hourly). Perhaps a false positive or sth.

Doktor Jones

@NogBadTheBad and now you've preserved it for posterity in your own post despite the fact that it's they've removed it