Nat Forwarding issue - just for new rules

[Speck]

Hi,

I have PfSense version 2.4.4 (same behavior with 2.4.2_1 I had before ) and I have a strange behavior with nat reflection.

i have let's say 50 rules, alla working fine ( Nat+proxy as system default ) now when i create a new rules, the nat reflection is not working only for this new rule.

tried using different ports and different public IP, same issue.

is seems that the rules are somehow cached and does not update.

is there a way to force reload of this rules?

in the system logs i see no errros, and upon fiter reloading all nat reflection rules "seems" to be created.

i also tried deleting an old rule and creating a new one but it's still not working. If i re-create the same old rule it still works...that's why I think of some "cache" .

all rules are 1 port port-forward so i have no more then 50 port-reflection.

what can I check?

thanks,
Speck

[johnpoz]

@speck said in Nat Forwarding issue - just for new rules:

is there a way to force reload of this rules?

Keep in mind that a reload doesn't kill OLD states...

Existing states are evaluated before rules - so depending on what your doing exactly with your rules, maybe you need to kill off any existing states related to whatever rules your creating/editing/deleting

[Speck]

@johnpoz Hi,

thanks for your reply.

forgot to mention I already tried to "force" filter reload and I've also rebooted the firewall just to be sure to "clear" existing states.

still same result, old rules works , new rule does not :(

in filter reload staus I can see "new" rules and it states the nat reflection rules are created.

i also see that xinetd deamon loads new services:

xinetd -Reconfigured: new=0 old=151 dropped=0 (services) ( ok, they are more then 50 :D )

let me know what else can I check!

thanks,
Michele

[Speck]

just some more info,

the states table looks like this:

the first two rows are from a WAN connection, and everything works fine.

the last three are from internal lan and guest WiFi, I always receive CLOSED:SYN_SENT

I've also take two dumps from Wifi and Lan, but as far as I can see there is only SynSent also in dumps.

i can upload them if needed.

Thanks,
Speck

[Speck]

Anyone wih any hint?

Thanks!

bye,
Speck