Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    opening ports on firewall

    Scheduled Pinned Locked Moved Firewalling
    38 Posts 7 Posters 5.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      richardlhughes
      last edited by richardlhughes

      What actually determines if a port is open on the firewall?

      I have been struggling on pfsense configuration.

      I have been trying to open ports 443 and 80 on my firewall to be re-directed to the appropriate lan ip address.

      I have tried using both NAT and HAPROXY however, I can only get port 443 to open and port 80 is not getting any traffic. I am at a loss to figure out why this is being blocked. I have looked over the following information:
      https://docs.netgate.com/pfsense/en/latest/book/firewall/troubleshooting-firewall-rules.html#firewall-troubleshooting-states

      I couldn't find anything that points to being a problem with my setup. I would appreciate some ideas what I could be doing wrong.

      Here is the rules I have on the firewall:

      pass ipv4 tcp any any self 80 any

      I've tried changing the destination to the different configurations however, nothing will resolve on port 80 to open the port.

      Thanks,
      Richard

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        I don't believe that you can forward a port that pfSense WebGUI is listening on. So, if you want to forward both tcp80 and 443, then you need to reconfigure your WebGUI to use some other port, like 81 or 444.

        1 Reply Last reply Reply Quote 0
        • R
          richardlhughes
          last edited by

          @KOM said in opening ports on firewall:

          tening on. So, if you want to forward both tcp80 and 443, the

          Yes, I have the webgui configured on a different non-standard port.

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by KOM

            Post screens of your NAT rules and WAN rules, maybe something there is wrong.

            You can do a packet capture on LAN filtered to your LAN server and see if NAT'd packets are leaving the pfSense LAN interface.

            1 Reply Last reply Reply Quote 0
            • A
              akuma1x
              last edited by

              Don't forget, your ISP also has to pass ports 80 and 443 thru to you over their connection. Since you said you can already get 443, I'm guessing they probably aren't blocking 80.

              Jeff

              R 1 Reply Last reply Reply Quote 0
              • R
                richardlhughes @akuma1x
                last edited by

                @akuma1x said in opening ports on firewall:

                also has to pass ports 80 and 443 thru

                I called them and they told me they are not blocking any ports.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • A
                  akuma1x
                  last edited by akuma1x

                  Ok then, I'm pretty sure this is how you set it up. I say pretty sure, because I've got some port forwards on my pfsense box, but not 443 or 80.

                  NAT/Port Forward
                  Interface: WAN
                  Protocol: TCP/UDP
                  Source Address: Any
                  Source Ports: Any
                  Destination Address: WAN Address
                  Destination Ports: 80 or 443 (pick one)
                  NAT IP: your internal server IP address
                  NAT Ports: 80 or 443 (pick one)
                  Description: name it something appropriate

                  Then, at the bottom of this NAT rule, in the Filter Rule Association, pick the option to Create New Rule. That will automatically make a firewall rule on your WAN interface to pass the traffic. In your WAN interface firewall rule list, make sure the 2 default block rules are at the top - block rfc1918 and block bogon networks. Make sure this new firewall rule you just auto-created is immediately under the block rules.

                  Make sure your server on the internal network can accept traffic, then test from outside the network to make sure you can hit the server box in question.

                  Jeff

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @richardlhughes
                    last edited by

                    @richardlhughes said in opening ports on firewall:

                    I called them and they told me they are not blocking any ports.

                    1st step in troubleshooting any port forward issues is actually validate the traffic gets to your wan... There is nothing pfsense can do if traffic never gets there.

                    So this should always be step one... its as easy as going to say can you see me .org and testing for port 80 while you sniff on your wan... Do you see it get there?

                    Doesn't matter what your ISP says.. they might not be blocking it, but maybe something else is - say a nat router in front of pfsense for example..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    Raffi_R 1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM
                      last edited by

                      @johnpoz I've already asked for screens and told him to do a packet capture but that advice was ignored.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        Your post stated lan, which sure is step 2... But he needs to actually validate the traffic gets there before anything.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        KOMK 1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          List of things to check here:

                          https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          R 1 Reply Last reply Reply Quote 0
                          • Raffi_R
                            Raffi_ @johnpoz
                            last edited by

                            @johnpoz said in opening ports on firewall:

                            @richardlhughes said in opening ports on firewall:

                            I called them and they told me they are not blocking any ports.

                            1st step in troubleshooting any port forward issues is actually validate the traffic gets to your wan... There is nothing pfsense can do if traffic never gets there.

                            So this should always be step one... its as easy as going to say can you see me .org and testing for port 80 while you sniff on your wan... Do you see it get there?

                            Doesn't matter what your ISP says.. they might not be blocking it, but maybe something else is - say a nat router in front of pfsense for example..

                            Another way to figure out if the ISP is not blocking ports is to use GRC service port scan.
                            https://www.grc.com/x/ne.dll?rh1dkyd2
                            They basically suggest running the All service port scan on a device not behind a NAT and with software firewall disabled (unprotected). Any ports that come up as stealth are most likely being blocked by your ISP. After running the test if you scroll down the Service Ports Scan Application Guide, you'll see more details on that. Of course don't forget to reenable the firewall after the test.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              That does not guarantee that something upstream is not responding on your behalf.

                              The only way to be 100% sure the traffic is arriving on your WAN is to packet capture on your WAN. If it does not arrive there, pfSense cannot forward it.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • KOMK
                                KOM @johnpoz
                                last edited by

                                @johnpoz I tend to do it the other way around because in my experience, the traffic almost always gets to WAN. The problem is usually with the NAT itself or some other PEBKAC thing.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  richardlhughes
                                  last edited by

                                  Wan Rules

                                  f4a5d494-681b-47c7-bbdd-bd4fa323656e-image.png

                                  NAT Rules

                                  bdc03aec-344d-43fa-ae5e-bf4f8a4d29b2-image.png

                                  HAPROXY (I've tried http and tcp for port 80 and cannot get port 80 open)

                                  9cb367d8-eb99-416a-ae6d-ba5cf95d1269-image.png

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    richardlhughes @Derelict
                                    last edited by

                                    @Derelict I have checked this list a couple times now. Didn't see anything standing out.

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      akuma1x
                                      last edited by akuma1x

                                      Alright, your NAT rules look correct, might want to make the protocol both TCP/UDP, and not just TCP.

                                      Your WAN rules are incorrect. Your FIRST set of 443 and 80 allow traffic to just your firewall, not another LAN machine. If you move these two new bottom rules to the very TOP of your firewall rule list, the traffic should move like you are expecting/hoping.

                                      Firewall rules are evaluated top down, first to match wins. That's why nothing is hitting 10.0.0.5, 80 and 443 are bouncing around inside the firewall itself, due to the first 2 top rules.

                                      Jeff

                                      DerelictD R 2 Replies Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        I don't know what didn't see anything standing out means. Did you see the SYN arrive or not?

                                        If you packet capture on WAN for port 32900 and test from the outside, you should see the SYN packet arrive.

                                        If you see it, then move your capture to the inside interface for port 32400, you should see the SYN packet sent to 10.0.0.37.

                                        If there is no response, look at the server (10.0.0.37) and see why.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        R 1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate @akuma1x
                                          last edited by Derelict

                                          @akuma1x said in opening ports on firewall:

                                          Alright, your NAT rules look correct, might want to make the protocol both TCP/UDP, and not just TCP.

                                          Pet peeve of mine. You shouldn't just randomly forward traffic. You should know if you need TCP, UDP, or both and forward what is required.

                                          If he pcaps filtering on just the port, it will show both.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 1
                                          • R
                                            richardlhughes @Derelict
                                            last edited by

                                            @Derelict I didn't do the packet capture on the WAN, the troubleshooting list.

                                            How do I setup packet capturing on the WAN? is this something I can setup on my pfsense machine or what is the best method?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.