Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT / Port Forward issue

    Scheduled Pinned Locked Moved NAT
    natport forwardport forwardingpublic ip
    14 Posts 3 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • chpalmerC
      chpalmer
      last edited by

      Go you have a "gateway" configured on the device that you are trying to serve from?

      Triggering snowflakes one by one..
      Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

      M 2 Replies Last reply Reply Quote 0
      • M
        mrdeckard @chpalmer
        last edited by

        Hi @chpalmer , thanks for the quick reply.
        Do you refer to the machine where web server is running? I've the gateway just for eth0 (where is still configured a static public IP, in order to continue to reach it) , but not for eth1 (LAN). In this case, I've tried to add to the configuration of eth1 (192.168.0.118 - web server) the property
        GATEWAY=196.168.0.1 (internal IP of pfsense), but machine became no more reachable also by public side...I don't know why....

        KOMK 1 Reply Last reply Reply Quote 0
        • KOMK
          KOM @mrdeckard
          last edited by KOM

          @mrdeckard So this web server at .118 has full access, can ping out to 8.8.8.8 etc? Your trace shows no response. I would do a capture on LAN when you run your test to make sure the packets are making their way through pfSense to the web server.

          Troubleshooting NAT Port Forwards

          M 1 Reply Last reply Reply Quote 0
          • M
            mrdeckard @KOM
            last edited by

            Hi @kom ,
            thank you for the replay.
            I confirm that I can ping 8.8.8.8. Soon I will try to make a capture on the webserver side. I'll let you know the outcome of the capture. Thanks again for your help.

            KOMK 1 Reply Last reply Reply Quote 0
            • KOMK
              KOM @mrdeckard
              last edited by

              @mrdeckard Make sure you go through that list I linked to. It's always something in that list that turns out to be the problem.

              M 1 Reply Last reply Reply Quote 0
              • M
                mrdeckard @KOM
                last edited by

                Hi @kom,
                I checked the troubleshooting procedures written in your link. It seems OK to me, and I have a doubt about the correct configuration of the gateway on the receiving machine (webserver). Can I show you the webserver routing table? I made the capture on the webserver side, and in fact, I find it strange. Below I show the capture made with tcpdump on eth1 (192.168.0.118) of the webserver when calling the public address of pfsense on port 8080.

                e86b93b0-ed27-4d4e-b76c-a14ee02264df-image.png

                I find the indication TPR Out-Of-Order very strange and then follow the TCP retransmission coming from my browser placed behind the router of my office.

                In fact, there never seems to be a response back from the webserver. What do you think? What useful information could I investigate?

                Thank you so much.

                KOMK 1 Reply Last reply Reply Quote 0
                • KOMK
                  KOM @mrdeckard
                  last edited by

                  @mrdeckard What does the web server show for:

                  ip route show
                  M 1 Reply Last reply Reply Quote 0
                  • M
                    mrdeckard @KOM
                    last edited by

                    Hi @kom,
                    I am very sorry to be able to answer just now. Unfortunately, I've been on the road these days and couldn't get to my test servers.
                    Before showing you the information on routing tables, I would like to thank you again for your support and your great spirit of help.

                    My web server's routing table is the following:

                    8d8cc22e-2807-44a5-a03b-8f4808437f71-image.png

                    As you can see, the address of 195.xxx.xxx.xxx is the IP class from the public side. So the public address exposed by the eth0 network interface is 195.xxx.xxx.91, while on eth1, there is the LAN side (192.168.0.118).

                    If it can be useful, observing the various, I observe a strange thing. For example, if I go to Status -> Gateway, I observe the following:

                    8b670f97-65b8-44ce-b684-4a8f73f95925-image.png

                    It appears that the Gateway on the public side is "duplicated" (forgive me for the lack of knowledge of pfsense and possibly some concepts), and one of the duets appears to be in a "Pending" state. I can not understand.

                    I thank you again!

                    KOMK 1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM @mrdeckard
                      last edited by

                      @mrdeckard Looks like your config has a prob;em. What do you have under System - Routing - Gateways?

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        mrdeckard @KOM
                        last edited by

                        Hi @kom ,
                        under System - Routing - Gateways I have the following situation:

                        863fd8e3-25a0-4bc8-8dfe-a481913b6d2f-image.png

                        Do you have any advice for me? Do you think it could be something I went wrong during the setup or something that went wrong during the installation?

                        Thank you so much!

                        KOMK 1 Reply Last reply Reply Quote 0
                        • KOMK
                          KOM @mrdeckard
                          last edited by KOM

                          @mrdeckard I don't know why you have two identical gateways but that can't be good. The second one appears to be the default created by pfSense. I would delete the first one and then try again.

                          Edit: I just noticed that the gateway set for your web server seems to be the public IP address of your WAN. It should be your pfSense LAN IP address.

                          M 1 Reply Last reply Reply Quote 1
                          • M
                            mrdeckard @KOM
                            last edited by

                            Hi @kom,
                            Excuse me. I realized right now that the real problem was in setting up my gateway on the webserver! So your observation is absolutely correct.
                            I corrected the Gateway on the webserver, setting it to the router/firewall address (on the private interface of pfsense 192.168.0.1).
                            Now the system works as expected.

                            I learned that you need to check the troubleshooting guidelines not 5 but 10 times!
                            Troubleshooting NAT Port Forwards

                            Thank you very much and thanks for your patience and support.

                            Thanks sincerely.

                            1 Reply Last reply Reply Quote 0
                            • M
                              mrdeckard @chpalmer
                              last edited by

                              Hi @chpalmer,
                              You were right; the problem was an incorrect gateway configuration on the webserver.

                              Thanks again!

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.