Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Firewall, Port forwarding Help

    Firewalling
    3
    18
    765
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Z
      z71prix last edited by

      Please help, I'm new to pfsense and have spent over 10 hours trying everything to get a simple port forwarding to work.  I've got knowledge of routers dd wrt and such.  It must be something simple I'm missing.

      pfsense installed on Qotom 4 port mini PC

      Interfaces
      igb0 = WAN
      igb0 = LAN1
      igb0 = LAN2

      I'm trying to port forward 5610 from incoming WAN traffic to a single IP on LAN2.

      Packet capture shows port 5610 on WAN, but not on LAN2

      My settings in attached

      If you need any anything else let me know.






      1 Reply Last reply Reply Quote 0
      • Grimson
        Grimson Banned last edited by

        Your configuration is wrong. RTFM: https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

        1 Reply Last reply Reply Quote 0
        • Z
          z71prix last edited by

          Thank you, I've added top rule to allow all traffic?  Is this correct?  Still not working?


          1 Reply Last reply Reply Quote 0
          • Grimson
            Grimson Banned last edited by

            @z71prix:

            Thank you, I've added top rule to allow all traffic?  Is this correct?  Still not working?

            Really READ the instructions I linked to, especially the bold parts, don't just skip over them. You don't need to create additional rules, you just have to configure the port forward right.

            1 Reply Last reply Reply Quote 0
            • Z
              z71prix last edited by

              I have read and read the tread thank you for sending it.  I'm so confused why it's not working?

              1 Reply Last reply Reply Quote 0
              • Z
                z71prix last edited by

                I'm setting up rule in NAT correct?

                1 Reply Last reply Reply Quote 0
                • Grimson
                  Grimson Banned last edited by

                  @z71prix:

                  I have read and read the tread thank you for sending it.  I'm so confused why it's not working?

                  From the linked instructions:

                  Destination: Specifies the original destination IP address of the traffic, as seen before being translated, and will usually be WAN address.

                  1 Reply Last reply Reply Quote 0
                  • Z
                    z71prix last edited by

                    I'm still trying?


                    1 Reply Last reply Reply Quote 0
                    • Z
                      z71prix last edited by

                      I've tried everything I can think of? Why is this so difficult?

                      1 Reply Last reply Reply Quote 0
                      • johnpoz
                        johnpoz LAYER 8 Global Moderator last edited by

                        does your camera even have a gateway?  This is very common with these sorts of devices.. They have not gateway on them - so no you can not view them from outside your network without doing source nat..

                        Also its bad idea to allow access to camera's from outside your network.. Huge security concern.. And these cameras are terrible when it comes to security..  That is your port forward - where is the wan rules?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by

                          your wan rule is WRONG..  you wouldn't set a gateway on a wan rule..  Nor is the source ever going to be your wan address.. on your lan 2 rule..  This is really clickity clickty - when you create the port forward it will auto create your firewall rule for you - so its like impossible to make such nonsense rules..

                          Your lan 2 doesn't even need a rule if your just going to be answering inbound connections from internet.. And if you did not a rule the source for sure would not be the wan address..

                          Rules are evaluated top down, first rule to trigger wins no other rules evaluated.  How would wan address be a source of inbound traffic to lan2 interface from the lan2 network?

                          edit:  remove that any any rule on your wan!!  Just let the port forward create the wan rule..

                          Is your camera have a gateway?  This is #3 in common problems on the troubleshooting guide..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                          1 Reply Last reply Reply Quote 0
                          • Z
                            z71prix last edited by

                            Hello Johnpoz

                            Yes, the camera has a gateway, it was working fine on my Netgear router before I switch to pfsense. The camrea is a private port I'm using with user interface log in.

                            I created a NAT rule, it created the WAN rule automatically.

                            Here's my NAT and WAN rules.




                            1 Reply Last reply Reply Quote 0
                            • johnpoz
                              johnpoz LAYER 8 Global Moderator last edited by

                              remove tht any any rule!!

                              So lets sniff the traffic - PM your public IP and I will hit it on that port.

                              You do not have anything in front of pfsense - pfsense has your wan… Lets see the sniff of your wan showing you hitting that IP from outside your network.. Your not trying to access this from inside your network hitting your public IP are you?

                              "The camrea is a private port I'm using with user interface log in."

                              Still bad idea - if you want to access stuff on your network, vpn in... Open up such devices to the public is just very bad idea!

                              I think your trying to hit your public IP from say you phone on your wifi network?  So it would be nat reflection - you need to test this from outside.. Either PM your public IP, or use canyouseeme.org

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                              1 Reply Last reply Reply Quote 0
                              • Z
                                z71prix last edited by

                                ok, any traffic rules removed.

                                I'll send you PM

                                thank you

                                1 Reply Last reply Reply Quote 0
                                • johnpoz
                                  johnpoz LAYER 8 Global Moderator last edited by

                                  Not seeing any syn,ack back - lets see your wan sniff when I send traffic or you use your online checker or canyouseeme.org

                                  Do you have any floating rules?  There is no syn,ack back from syn I send to that port

                                  10:44:12.574054 IP 64.53.xxx.xxx.37854 > 68.38.xxx.xxx.5160: tcp 0
                                  10:44:12.824552 IP 64.53.xxx.xxx.54289 > 68.38.xxx.xxx.5160: tcp 0
                                  10:44:15.571615 IP 64.53.xxx.xxx.37854 > 68.38.xxx.xxx.5160: tcp 0
                                  10:44:15.823196 IP 64.53.xxx.xxx.54289 > 68.38.xxx.xxx.5160: tcp 0

                                  If the traffic is hitting your wan then sniff on your lan2 interface for that 5160…

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                  1 Reply Last reply Reply Quote 0
                                  • johnpoz
                                    johnpoz LAYER 8 Global Moderator last edited by

                                    Fixed… Wow what a mess that was...

                                    vpn client pulling routes, outbound nat source natting to lan2 interface..  Working now.

                                    If you want to use a vpn client and port forwarding inbound, then you have to correctly set that up - you can not force all traffic out your vpn by pulling routes and expect inbound traffic into your want to answer via your vpn.

                                    And a downstream nat to boot ;)


                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                    1 Reply Last reply Reply Quote 0
                                    • Z
                                      z71prix last edited by

                                      Thank you so much for your support!!!

                                      1 Reply Last reply Reply Quote 0
                                      • johnpoz
                                        johnpoz LAYER 8 Global Moderator last edited by

                                        Your welcome - but the info about your vpn client and that you were double natting downstream of pfsense is helpful info.

                                        I do not see why your downstream natting other than you are leverage some old router for something… Just use it as switch or AP, it makes no sense to double nat, etc.  And for sure would make it a real pain to port forward to anything behind that downstream router.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post