Port forward plex



  • I am new to pfSense, I have two servers for plex, 1 for movies and 1 for tv shows. I have upnp enabled.Each server is a separate computer. The one for movies has an ip of 192.168.0.2, and the one for tv shows has an ip of 192.168.0.1. My gateway is 192.168.0.25. I can not reach my movies plex server from outside the network, but I can reach the server for tv shows from outside the network. I added a port forward rule to 192.168.0.2 using 50000 as the source port and 32400 as the destination port. It will work outside the the network for about 20 minutes then stop. the PFsense log states that 192.168.0.2 is blocked. Can someone explain to me what I am doing wrong. The tv show server works fine outside the network with just upnp. They both worked fine when I was using an Asus RT-68uac, with forwarding the ports for each.




  • Rebel Alliance

    "with forwarding the ports for each."

    Why don't you do that vs the UPnP nonsense?

    You could have as many plex boxes as you want behind your nat… Just forward whatever port you want to use on the outside to the IP:32400 for that different plex box.

    Setup in each plex the manual port forwarding your using calling out your public port your using..



  • I am trying to that with my movies plex server. do I have to turn off upnp also.


  • Rebel Alliance

    Plex does not allow for both UPnP and manual - does it… Would make ZERO sense if it did..



  • I read the instructions on how to port forward, I am including 2 screen shots. 1 for customplugin and 1 for Sophia. Sophia is working fine outside the network, but customplugin is not. can someone tell me what i am doing wrong.

    ![Screenshot (19).png](/public/imported_attachments/1/Screenshot (19).png)
    ![Screenshot (19).png_thumb](/public/imported_attachments/1/Screenshot (19).png_thumb)
    ![Screenshot (20).png](/public/imported_attachments/1/Screenshot (20).png)
    ![Screenshot (20).png_thumb](/public/imported_attachments/1/Screenshot (20).png_thumb)


  • Rebel Alliance

    Lets see your wan rules.

    So when you go to canyouseeme org and check for port 45500 does it come back.

    Did you go through the port forward troubleshooting guide?  Maybe traffic never gets to pfsense? etc..

    https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting



  • I went to canuseeme.org, and i got an error. The funny thing is why does the sophia server work outside the network, and customplugin_1 does not. I have an ATT  5268AC using DMZ to the pfsense router. The router to a switch to the servers. I also have an Asus rt68u-ac in ap mode for wireless. When I used the asus as the main router the plex servers worked outside the network all the time with port forwarding.I am sending the plex screenshots

    ![Screenshot (21)b.jpg](/public/imported_attachments/1/Screenshot (21)b.jpg)
    ![Screenshot (21)b.jpg_thumb](/public/imported_attachments/1/Screenshot (21)b.jpg_thumb)
    ![Screenshot (22)b.jpg](/public/imported_attachments/1/Screenshot (22)b.jpg)
    ![Screenshot (22)b.jpg_thumb](/public/imported_attachments/1/Screenshot (22)b.jpg_thumb)



  • I am lost, here is the screen from canuseeme

    ![Screenshot (23).png](/public/imported_attachments/1/Screenshot (23).png)
    ![Screenshot (23).png_thumb](/public/imported_attachments/1/Screenshot (23).png_thumb)


  • Rebel Alliance

    where are your wan rules?



  • here are the rules

    ![Screenshot (24).png](/public/imported_attachments/1/Screenshot (24).png)
    ![Screenshot (24).png_thumb](/public/imported_attachments/1/Screenshot (24).png_thumb)
    ![Screenshot (25).png](/public/imported_attachments/1/Screenshot (25).png)
    ![Screenshot (25).png_thumb](/public/imported_attachments/1/Screenshot (25).png_thumb)
    ![Screenshot (26).png](/public/imported_attachments/1/Screenshot (26).png)
    ![Screenshot (26).png_thumb](/public/imported_attachments/1/Screenshot (26).png_thumb)



  • 2 more screens

    ![Screenshot (27).png](/public/imported_attachments/1/Screenshot (27).png)
    ![Screenshot (27).png_thumb](/public/imported_attachments/1/Screenshot (27).png_thumb)
    ![Screenshot (28).png](/public/imported_attachments/1/Screenshot (28).png)
    ![Screenshot (28).png_thumb](/public/imported_attachments/1/Screenshot (28).png_thumb)


  • Rebel Alliance

    What?  Dude show me your wan rules… Like this!




  • I hope this is it

    ![Screenshot (29).png](/public/imported_attachments/1/Screenshot (29).png)
    ![Screenshot (29).png_thumb](/public/imported_attachments/1/Screenshot (29).png_thumb)


  • Rebel Alliance

    Why in the world do you have an ANY ANY rule on your wan???  Remove that!!!



  • sorry, don't understand. Do I remove any from the rule and what do i replace with. Can you please show me an example


  • Rebel Alliance

    Dude Delete the ANY ANY rule you have on the top - Why would you have that??




  • deleted it, but still no access outside of network for custom, Sophia has no problem. Can,t figure this one.



  • Does the ATT 5268AC router modem have anything to do with this. I am using dmz to the pfsense router, and the pfsense to a switch.


  • Rebel Alliance

    Lets see your port forward tab..

    If can you see me org shows that it can not talk to your plex then no it will not work… So you need to go through the troubleshooting guide I linked too and figure out why.

    First step is to make sure the traffic even gets to pfsense, simple package capture on wan interface while you run your can you see me org test.

    If that is there, then packet capture on the lan interface - does pfsense send the traffic on?  If so then the problem lays with the plex box.  Maybe its not actually listening on 32400, maybe there is a firewall, maybe it doesn't point back to pfsense as its gateway? etc..

    It really should take only a couple of minutes to determine where the problem is.

    So I added a port forward for 45500 to my plex box on 34200... I then go to can you see me..  Run the test, while I repeat this test I sniff on both the wan interface and the lan interface.

    As you can see in my case even on the wan sniff I can see replies..  But lets assume it didn't show any responses but I did see the traffic to my wan IP on port 45500, I would then sniff on the interface the server I am forwarding to on (lan in my case) and see if pfsense send on the data to 192.168.9.10 - which it does in my case.  But lets say I didn't see any response from 192.168.9.10.. If that is the case then it SCREAMS something wrong on that box.

    Be it wrong IP for plex, firewall on the plex box.  Plex not listening on that port, etc.  If you do not see pfsense sending to 192.168.9.10 in my case.  Maybe there is no machine on that IP?  And pfsense can not arp for it - can you ping that IP from pfsense? etc..

    Pretty much every possible scenario is gone over in the troubleshooting doc..  If you have questions on how to do something specific in that doc then please ask.  But the attached walks you through very simple method of traffic down where the problem is.  First thing to always validate is the traffic actually gets to pfsense.

    Hope that helps..  If you want - if this is confusing.. Later today we could do a teamviewer and I could take a look remotely.




  • @johnpoz
    I'm just curious, in you firewall rules, WAN.You have one rule at the bottom. You call it "Clean Block" Do you like to share the settings you have inside that rule?

    Thanks in advance!


  • Rebel Alliance

    Its just there so I only log SYN… I don't care to see the UDP noise and any sort of out of state block.  So I turn off logging of the default block, and then only log SYN packets..

    Just set the SYN tcp flag is all in the advanced option.. This removes all the nonsense UDP noise and out of state nonsense that really don't care to see... But I am curious to what is the common ports being hit.. 3389, 22, 23, 1433, you know the typical ones.  But for example when that worm on the Mikrotik botnet was becoming popular saw a lot of port 8291 which was interesting..

    Still see that 8291 now and thing - just looked saw a hit back on 15th ;)



  • @johnpoz:

    Its just there so I only log SYN… I don't care to see the UDP noise and any sort of out of state block.  So I turn off logging of the default block, and then only log SYN packets..

    Just set the SYN tcp flag is all in the advanced option.. This removes all the nonsense UDP noise and out of state nonsense that really don't care to see... But I am curious to what is the common ports being hit.. 3389, 22, 23, 1433, you know the typical ones.  But for example when that worm on the Mikrotik botnet was becoming popular saw a lot of port 8291 which was interesting..

    Still see that 8291 now and thing - just looked saw a hit back on 15th ;)

    Thank you very much. I didn't think about this. Great idea to show if some shit is going on and more easy to read, instead of using "Log firewall default blocks"(to much noise) Yeah, i can see some of the ports you mentioned now in my log  :o :)

    Little bit off topic, sorry :)



  • I want to thank you very much, after all the headaches it was something stupid on my end. I decided to log into my freenas which runs my customplugin server, and there it was the plex plugin was off. Could not turn it on, so I rebooted and the plex plugin strted again and now everything is working. Thank you for all your help in this matter. I now a little more on port forwards,and firewall rules thanks to you.


  • Rebel Alliance

    And don't forget you removed the any any rule that basically opened up your web gui to the world - so anyone on the planet might of guessed your pfsense username and password or sshed to it, etc. etc..

    Why did you create the any any rule on your wan?


 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy