[Solved] I'm apparently unable to port forward...

  • Hi.

    I tried everything I could to make port forwarding work, but it doesn't.

    I don't really think it's my ISP since port forwarding works nicely on my Mikrotik router.

    I don't have any blocking rule above the port forwarding rules. they're on top of everything.

    here's my config:

    alt text
    alt text
    alt text
    alt text
    alt text
    alt text
    alt text

    Thank you!

  • Rebel Alliance Global Moderator

    Dude it is ALWAYS PEBKAC.. I can understand frustration when something doesn't work.. But in the 10+ years I have been here it is always something the user overlooks or doesn't do, etc.

    Did you go through the troubleshooting guide - it will allow you find where the problem is in a few minutes.

    For starters you have NO rule on your WAN... How is 8889 going to get to your 192.168 address when you do not have a rule listed on your wan to allow it. When you create the port forward it will automatically create this rule for you unless you tell it not too.. So where is the rule? It would look like this.


    As to not pinging your WAN address.. Simple sniff on your wan when you do that - does it GET there??? That takes all of 30 seconds to do.. Your rule has zero hits on it.. So you can not allow for ping if pfsense never sees the request..

  • I tried manually adding a rule allowing port 8889 at WAN Address, but also didn't work.

  • Rebel Alliance Global Moderator

    And SNIFF does it GET there??? Seems your pings are not.. So who says 8889 is? What do you have front of pfsense?

    Simple diag, packet capture wan... port 8889 then do your test.


    Mines not going to work since I don't have anything at - but you can see the traffic got to my wan

  • nothing... just a media converter (fiber>ethernet) and it's "bridged" by default..

    that website can't ping me, but that one friend on another city can, but he can't access my website..

  • I also tried using things like "free proxy" to access the website (hosted on 8889) but didn't worked.

  • Rebel Alliance Global Moderator

    First step into troubleshooting is SNIFF!!! IF the traffic doesn't get to pfsense wan it is IMPOSSIBLE for it to be forwarded..

    PM me your wan IP and I will attempt ping

  • what do you mean by sniff?

  • Rebel Alliance Global Moderator

    Packet capture under diagnostics - I posted example above of hitting 8889 to my IP.

  • Rebel Alliance Global Moderator


    Start the capture - then use like can you see me to that port... Do you see the traffic??

  • alt text

    alt text

  • Rebel Alliance Global Moderator

    So if NOTHING gets to your wan - how could pfsense ever forward it??

    Pfsense can not forward what it doesn't see - pfsense has ZERO control of traffic getting to its wan.. You need to look upstream

  • I don't know, dude.. I don't know what's happening

  • Rebel Alliance Global Moderator

    Get with your ISP on why your not seeing that traffic.. Pfsense can NOT forward what it doesn't see!! Its that simple..

  • Rebel Alliance Global Moderator

    @ninom4ster said in I'm apparently unable to port forward...:

    that website can't ping me, but that one friend on another city can, but he can't access my website..

    PM me your IP... I will setup a ping to your IP... Lets see if you answer. If does or doesn't even you can sniff while doing it.

  • I already called them. they're not blocking anything. and as I said, it works perfectly with my Mikrotik. (with the exact same ports open)

  • Rebel Alliance Global Moderator

    Well they are lying or don't understand what your asking... If you sniff and there is nothing there for that port - then pfsense can never forward traffic that doesn't get to it!!

    I have ping going - and NOTING.

    PM you my IP.. Sniff for it..

  • Rebel Alliance Global Moderator

    Get a ping going to my IP... And will validate your coming from that IP..

    keep it running with -t if windows...

  • I also "sniffed" the port 80, because that's where the web page is hosted on, locally..

    internet > TCP 8889 (WAN) > NAT > TCP 80 (my webserver)

  • Rebel Alliance Global Moderator

    doesn't matter what you listen on locally!!! If it never gets to your wan then it can not forward it - PERIOD!!! Not rocket science here ;)

    Are you pinging me

  • Rebel Alliance Global Moderator

    Seem you got ISP issues...

    Run your continue ping -- while I sniff... And show you that I am answering..

  • Rebel Alliance Global Moderator

    here - I am answering you!!! IF you not getting it that is on your ISP..


  • I'm gonna shutdown pfSense and switch to Mikrotik to try something..

  • Rebel Alliance Global Moderator


    And your IP will change! Or you MAC will change - etc etc..

    What part do you NOT get about pfsense not seeing traffic it can not FORWARD?? Pfsense has no control of what hits is interface or not... Is pfsense a VM? Or hardware?

    Here is where trace stops
    aut-num: AS16735
    abuse-c: CST87
    owner: ALGAR TELECOM S/A

    Tracing route to 187.73.x.x over a maximum of 30 hops
      1    <1 ms    <1 ms    <1 ms
      2    12 ms     9 ms     8 ms
      3     9 ms     8 ms     9 ms
      4    10 ms    10 ms     9 ms
      5     9 ms    12 ms    17 ms
      6    11 ms    10 ms     9 ms
      7    11 ms    13 ms    20 ms
      8    16 ms    12 ms    12 ms
      9    12 ms    12 ms    12 ms
     10    34 ms    35 ms    33 ms
     11    31 ms    32 ms    31 ms
     12   179 ms   178 ms   190 ms
     13   178 ms   180 ms   181 ms
     14   193 ms   176 ms   178 ms
     15   177 ms   176 ms   177 ms
     16     *        *        *     Request timed out.
     17     *        *        *     Request timed out.
     18     *        *        *     Request timed out.
     19     *        *        *     Request timed out.
     20     *        *        *     Request timed out.
     21     *        *        *     Request timed out.
     22     *        *        *     Request timed out.
     23     *        *        *     Request timed out.

  • it's hardware.

  • This post is deleted!

  • This post is deleted!

  • Rebel Alliance Global Moderator

    Dude don't worry about it - but Pfsense can not forward what it can not see!!! Period.. If pfsense is not seeing the traffic - then its hardware related or something upstream is blocking it.. Pfsense can not forward what it doesn't get, you can not see an answer to your ping if it doesn't get there..

    Did you change it what is your IP now?

    Is this your ISP?

  • Netgate

    @ninom4ster said in I'm apparently unable to port forward...:

    am like that.. I want things to FUCKING WORK.
    I don't want to debug anything.


    If the traffic does not arrive on WAN there is nothing for the firewall to forward.

    You are going to have to figure out what is going on upstream preventing that traffic from being sent to you. When you have debugged that, your port forward will work. Sorry that maintaining a network is sometimes work. Good luck with your ISP.

    That packet capture is before rules, before snort, before everything. The connections from the outside are not arriving on WAN.

  • @johnpoz :

    If the traffic does not arrive on WAN there is nothing for the firewall to forward.

    @Derelict :

    If it never gets to your wan then it can not forward it

    Okay, okay... but I don't really understand how I can solve that...

    I will soon grab an old notebook and do a clean install of Ubuntu Server with Apache on all the default settings, and also format my current pfSense box.... once again... just to see if the problem is my web server or not..

    I don't know what else to try, honestly..

  • ah, I may also try the apparently less buggy version, 2.4.3...

  • Netgate

    It is not a bug - at least not in pfSense. You need to figure out why your upstream/ISP is not forwarding the traffic to you. There is nothing pfSense can do with traffic it never receives.

  • But wait.. isn't the Packet Capture thing supposed to show something up when I "sniff" the WAN? I mean, it's a local procedure, right?
    I got confused when you guys told me "it can't forward what it can't see" because I didn't know if you were talking about the WAN or the LAN.

    Also, wasn't pfSense supposed to work out-of-the-box? =/
    I'm almost sure that it was working perfectly when I first set it up weeks ago.. even port forwarding..

    As I already mentioned, it couldn't be my ISP. Port Forwarding works perfectly on my Mikrotik router (when I swap Pf with it).

    What's the chance of it being a hardware problem? I'm still not running a Intel NIC since they're unbelievable expensive here where I live..

    WAN is the onboard NIC on this MB (apparently Realtek), and LAN is a... (also apparently) Realtek generic gigabit NIC.


  • Netgate

    Are you saying you weren't packet capturing on WAN?

    If so, do so, and report what you see there. Here's the deal. You are expecting connections from the internet to your WAN address on TCP port 8889. If you packet capture for that traffic ON WAN, test an inbound connection, and the packet capture DOES NOT INCLUDE THAT TRAFFIC then there's nothing pfSense can do. You need to get with your ISP and ask them why they do not forward the traffic to this device but do to that device. It's as simple as that.

    If you DO see the traffic then we can work with that.

    pfSense does work out of the box for a great many people.

    And Realtek NICs are generally considered about as crappy as you can get, but they generally work in most cases.

    If Intel is too expensive Broadcom is leaps and bounds better than Realtek.

  • Rebel Alliance Global Moderator

    The picture he posted was on his WAN.. There was nothing there to port 8889..

    You want to meet the train engineer - hard to meet him if the train never pulls into the station.. So how could pfsense forward traffic to a device on your lan, if it never sees it on the wan.. This isn't freaking rocket science here ;)

    You say it works on your old router.. Well that router going to be a different IP, its going to be a different MAC address of the device connected to the isp. Your isp could be filtering on unknown mac? What is the device your connecting pfsense too exactly what is the make and model number? When you connect pfsense to this device - you actually see the public IP on pfsense wan? 187.73.x.x ?? Or do you see some other IP like 192.168.x.x, 10.x.x.x or 172.16-31.x.x ??

    If you do not get the public IP yuo say is yours on the the wan interface of pfsense - then it is behind a NAT. And the device doing that nat has to be told to send the specific traffic to pfsense WAN ip.. or no pfsense will never see the traffic to be able to forward to your 192.168 box on your lan.

  • I understand enough about NAT. It is indeed exposed externally, since the WAN does get an external address. I know what I'm doing.

    I just noticed that I got something wrong when I tried using the Packet Capture.. I was really tired and for some reason I thought it generated traffic itself, somehow.. (don't blame me, it was 3 in the morning..) so that's probably why it was blank..

    I might try again another day.. Unfortunately I can't simply shutdown everything (to swap the devices) since my dad uses the Internet constantly for wotk..


  • Rebel Alliance Global Moderator

    So what is your public IP now - PM it to me.. And validate that it answers ping.. And if the port forward works, etc.

    Cuz the IP you sent me still is not answering ping.. So whats the IP when you use this other router..

  • Sent.

    And btw, my ISP shouldn't block unknown Mac, or else I wouldn't have internet access at all. not even outgoing.

  • Rebel Alliance Global Moderator

    Doesn't always work that way.. Many an isp allows mac address for some access until its registered, etc. Is quite possible for you to have 1 sort of access with known mac, and then limited sort of access when you have another mac until it gets registered, etc.

    Your IPs are in completely different net blocks.. So its possible traffic inbound works on netblock A, but not when using netblock B..

    BTW your new IP doesn't ping either.. But I do show 8889 being open.

    How come you could not ping my IP? Can you ping my IP now? I showed you when you pinged me before I that I sent a reply.. But you didn't get it, etc. Its possible maybe they have issues on the netblock you get when you install pfsense. Simple test of that would be to clone the mac address of your router so that pfsense uses the same mac on its wan.. This way you "should" get the exact same address as this router for your wan.