Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Limit number of ports used on WAN due to CGNAT

    Scheduled Pinned Locked Moved NAT
    5 Posts 2 Posters 376 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      digitalgeek
      last edited by

      I'm been having some IPv4 connection issues lately and reached out to my ISP. Long story short, they are saying that due to CGNAT each customer can use 4096 ports on the WAN side. According to them, I am going beyond this limit which results in "Destination Unreachable" a lot more often than I would like. So, is there a way to somehow limit the WAN side number of ports used or more aggressively close inactive ports/connections?

      Thanks,
      DG

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        And how many states does pfsense currently show having open?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • D
          digitalgeek
          last edited by

          At the moment, hovering around 1000 plus or minus a couple hundred. Assuming "State Table Size" is accurate, I guess I should be monitoring that when I have issues.

          Extra bits: When I have those connection issues, if I enable a VPN on a device (my phone for example) I can connect to the sites without issue. When I disable the VPN, the site still refuses to load. I originally posted over on Routing but after hearing back from my ISP, I thought this was a better place for it.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            well if your only showing 1000 states your no where near the 4096 they say you should have.. Or they are not clearing your old ones out.. That state table is also going to be say double what you would have eternally used, because it will be tracking your local side state through your nat as well.

            But sure a vpn would be one way to mitigate their port issue, since you would only have the 1 connection open to your vpn provider.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • D
              digitalgeek
              last edited by

              Yeah, and I imagine my IPv6 connections are in that state table too so probably a little less than half of that table is actually external IPv4 states.

              I figured I would mention the VPN thing to see if that made sense based on what my ISP was telling me (sounds like it does). I originally thought my issues were routing related because the ISP equipment kept responding with "Destination Unreachable" for seemingly random sites at random times.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.