How to close Port 23, 53 and 80 on WAN?
-
And there you go - you see the traffic get there and ZERO answers... So are we done now?
Doing exactly what it should be doing..
-
Does that mean, even if it comes from VPN, it still blocked?
-
OMG dude - what part are you not getting about it is NOT coming down your freaking vpn!!
The vpn is like your router in front of pfsense - pfsense didn't see shit until you forwarded the ports... Have you forwarded them on your vpn? Then they wouldn't be coming down your tunnel to pfsense..
But you can block them all you want on the vpn interface you created that connects to your vpn.
-
I think I got it now, so I actually had what I wanted the whole time.
But why are the Ports displayed as open, if stopped on VPN NAT?
-
Dude they are showing open because your VPN service is running them - NOT that they are being sent down the tunnel to you... This has been like talking to a wall!!
If you enable remote access on your router and have it listen to port 80.. Does it send that 80 to some client behind it..
Your vpn service is just like a nat router.. And the clients using it are like your devices behind your router..
Your not connected to that vpn service now right - well scan that IP you had.. What does it show open - while your not even connected to it.
-
You cannot control what traffic arrives on your outside interfaces. All you can do is block it (not pass it) which is exactly what it happening there.
the pfSense firewall, at its basic level, blocks all traffic into and out of any interface unless otherwise passed.
There are some pass rules placed by default, like passing anything initiated by LAN hosts.
If you do not put pass rules on your WAN, or your OpenVPN/assigned interface tab if that is also a WAN (as in the case of using a VPN provider) then any traffic initiated from the outside into those interfaces will be blocked (not passed - because there are no pass rules).
I provided the answer to your question two days ago:
Derelict 2 days ago
Something in front of your pfSense firewall is likely responding on those. -
Your not connected to that vpn service now right - well scan that IP you had.. What does it show open - while your not even connected to it.
VPN turned off and all ports forwarded to pfSense.
Online scans show no open ports.
Nmap also shows no open ports, although I've run all 65535 TCP and even all UDP.That's a relief, thank you for clarifying.
I provided the answer to your question two days ago:
You're right, it's just that I'm new to pfSense, so I'm not really confident to work with sensitive data, if I don't understand the basics.
-
@Bernd6560 said in How to close Port 23, 53 and 80 on WAN?:
VPN turned off and all ports forwarded to pfSense.
Online scans show no open ports.The pfSense firewall would not be responding even if ports were forwarded to it.
Something UPSTREAM of it was responding. Maybe they turned that off.
-
The pfSense firewall would not be responding even if ports were forwarded to it.
(VPN ON, Portforwarding OFF)
Whats going on here?
-
Those look like outbound connections again. You are showing a test to 81.X.X.X and a packet capture on 52.202.215.126.
I have no idea how you can think those are related.
-
Dude you seem to be just over your head is all... As derelict stated those are outbound.. Your seeing your own connection to the site your using to test
canyouseeme.org [52.202.215.126]
with would be my guess. That port for the 52 address is 443, that is the dest port of your test.. Yeah when you GO to that site you will see traffic to that site on the port you go too, ie https would be 443..
Then you have a 10 address.. Which your hiding? Why??? Its rfc1918 address..
