• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[Solved] I'm apparently unable to port forward...

Scheduled Pinned Locked Moved Firewalling
85 Posts 5 Posters 13.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • N
    NinoM4ster
    last edited by NinoM4ster Oct 24, 2018, 1:29 PM Oct 21, 2018, 3:34 PM

    Hi.

    I tried everything I could to make port forwarding work, but it doesn't.

    I don't really think it's my ISP since port forwarding works nicely on my Mikrotik router.

    I don't have any blocking rule above the port forwarding rules. they're on top of everything.

    here's my config:

    alt text
    alt text
    ######################
    alt text
    alt text
    ######################
    alt text
    alt text
    alt text

    Thank you!

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz Oct 21, 2018, 4:06 PM Oct 21, 2018, 4:03 PM

      Dude it is ALWAYS PEBKAC.. I can understand frustration when something doesn't work.. But in the 10+ years I have been here it is always something the user overlooks or doesn't do, etc.

      Did you go through the troubleshooting guide - it will allow you find where the problem is in a few minutes.

      For starters you have NO rule on your WAN... How is 8889 going to get to your 192.168 address when you do not have a rule listed on your wan to allow it. When you create the port forward it will automatically create this rule for you unless you tell it not too.. So where is the rule? It would look like this.

      0_1540137817683_pforward.png

      As to not pinging your WAN address.. Simple sniff on your wan when you do that - does it GET there??? That takes all of 30 seconds to do.. Your rule has zero hits on it.. So you can not allow for ping if pfsense never sees the request..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • N
        NinoM4ster
        last edited by Oct 21, 2018, 4:07 PM

        I tried manually adding a rule allowing port 8889 at WAN Address, but also didn't work.

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Oct 21, 2018, 4:11 PM Oct 21, 2018, 4:08 PM

          And SNIFF does it GET there??? Seems your pings are not.. So who says 8889 is? What do you have front of pfsense?

          Simple diag, packet capture wan... port 8889 then do your test.

          0_1540138257369_sniff.png

          Mines not going to work since I don't have anything at 192.168.10.6 - but you can see the traffic got to my wan

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • N
            NinoM4ster
            last edited by Oct 21, 2018, 4:10 PM

            nothing... just a media converter (fiber>ethernet) and it's "bridged" by default..

            that website can't ping me, but that one friend on another city can, but he can't access my website..

            J 1 Reply Last reply Oct 21, 2018, 4:21 PM Reply Quote 0
            • N
              NinoM4ster
              last edited by Oct 21, 2018, 4:11 PM

              I also tried using things like "free proxy" to access the website (hosted on 8889) but didn't worked.

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz Oct 21, 2018, 4:12 PM Oct 21, 2018, 4:12 PM

                First step into troubleshooting is SNIFF!!! IF the traffic doesn't get to pfsense wan it is IMPOSSIBLE for it to be forwarded..

                PM me your wan IP and I will attempt ping

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • N
                  NinoM4ster
                  last edited by Oct 21, 2018, 4:12 PM

                  what do you mean by sniff?

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by Oct 21, 2018, 4:13 PM

                    Packet capture under diagnostics - I posted example above of hitting 8889 to my IP.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Oct 21, 2018, 4:15 PM

                      here
                      0_1540138516638_runyourtest.png

                      Start the capture - then use like can you see me to that port... Do you see the traffic??

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • N
                        NinoM4ster
                        last edited by NinoM4ster Oct 21, 2018, 4:17 PM Oct 21, 2018, 4:17 PM

                        alt text

                        alt text

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Oct 21, 2018, 4:18 PM Oct 21, 2018, 4:17 PM

                          So if NOTHING gets to your wan - how could pfsense ever forward it??

                          Pfsense can not forward what it doesn't see - pfsense has ZERO control of traffic getting to its wan.. You need to look upstream

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • N
                            NinoM4ster
                            last edited by Oct 21, 2018, 4:18 PM

                            I don't know, dude.. I don't know what's happening

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Oct 21, 2018, 4:19 PM

                              Get with your ISP on why your not seeing that traffic.. Pfsense can NOT forward what it doesn't see!! Its that simple..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator @NinoM4ster
                                last edited by johnpoz Oct 21, 2018, 4:21 PM Oct 21, 2018, 4:21 PM

                                @ninom4ster said in I'm apparently unable to port forward...:

                                that website can't ping me, but that one friend on another city can, but he can't access my website..

                                PM me your IP... I will setup a ping to your IP... Lets see if you answer. If does or doesn't even you can sniff while doing it.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • N
                                  NinoM4ster
                                  last edited by johnpoz Oct 21, 2018, 4:22 PM Oct 21, 2018, 4:21 PM

                                  I already called them. they're not blocking anything. and as I said, it works perfectly with my Mikrotik. (with the exact same ports open)

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz Oct 21, 2018, 4:24 PM Oct 21, 2018, 4:23 PM

                                    Well they are lying or don't understand what your asking... If you sniff and there is nothing there for that port - then pfsense can never forward traffic that doesn't get to it!!

                                    I have ping going - and NOTING.

                                    PM you my IP.. Sniff for it..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by Oct 21, 2018, 4:25 PM

                                      Get a ping going to my IP... And will validate your coming from that IP..

                                      keep it running with -t if windows...

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • N
                                        NinoM4ster
                                        last edited by Oct 21, 2018, 4:25 PM

                                        I also "sniffed" the port 80, because that's where the web page is hosted on, locally..

                                        internet > TCP 8889 (WAN) > NAT > TCP 80 192.168.10.6 (my webserver)

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz Oct 21, 2018, 4:27 PM Oct 21, 2018, 4:26 PM

                                          doesn't matter what you listen on locally!!! If it never gets to your wan then it can not forward it - PERIOD!!! Not rocket science here ;)

                                          Are you pinging me

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          20 out of 85
                                          • First post
                                            20/85
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received