Nothing gets through except Plex
-
I recently switched from an Asus wireless router to a PFsense machine, and while using the Asus device all of my services were accessible from outside the LAN. Friends could use my Minecraft server, Plex worked from anywhere, and I could access my webpage from work, etc.
Since switching to PFsense I get much better speed for internet connections, but the only service that I can access from outside of my house is Plex for some reason. I still use the old Asus router as a wireless access point. I've assigned my devices the same static IPs they had on my old router and can access the services from inside my house just fine.
I have set up port forwarding rules for everything and cannot figure out why Plex is accessible but nothing else is. Canyouseeme.org says connections to 25565 are refused, and connections to ports 80 and 8080 time out.
I'd greatly appreciate some insight into how to fix this
-
Post screens of your WAN rules and NAT port-forwards. Obscure any public details like your WAN IP address, for example.
-
Edit: uploaded the screenshots
-
You can post images here directly. Look for the Upload Image button on the far-right of the Edit bar.
I didn't see your WAN rules in the list of screens. Normally, an associated firewall rule gets created on WAN to allow the NAT'd traffic, and I wanted to check that it was there. Otherwise your NATs look good and things should work.
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting
-
I'll post the list of WAN rules after work. Thanks for taking time to help
-
I've noticed that both Apache rules look identical, despite port forwarding needing to NAT port 80 to 8080. I might not have set the port forwards for that correctly.
-
And you can see from you rules that your rules that are not working have zero hits.. Means pfsense never saw the traffic...
I have been using pfsense for 10 years.. And in the 10 years I have been using it, and on this forum - not once have I seen an issues with port forwarding that was not user error.. This is not rocket science.. You forward the port - the traffic gets to pfsense it sends it on..
Here.
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.htmlStep one in port forwarding is validate that pfsense is actually seeing what your wanting to forward... It takes all of 10 seconds to sniff and hit up can you see me . org to validate your traffic actually gets to pfsense for it to forward.
-
I've uploaded the screenshots to my second post here. I'm just here to learn how to use the software, not to criticize it. I used canyouseeme before my initial post. SSH and plex are visible, yet despite being configured in nearly an identical way, Apache times out and the minecraft port's connection is refused. These services all work locally, so I'm just confused, as my username implies.
-
Your ISP may be blocking incoming traffic to those ports. Run a packet capture on WAN (Diagnostics - Packet Capture) and then try your tests from the WAN side. Stop the capture and see if pfSense sees the traffic at all. That will confirm if it's being blocked upstream.
-
And again - it takes all of 10 seconds to actually validate the traffic is getting to you... This is always going to be step one.. Pfsense can not forward what it doesn't see.,
Use can you see me . org - sniff...
Do you see this traffic get to pfsense? Not sure what you think how those screen shots would help... We need to see 2 screen shots.. Your actual port forward page, and the wan firewall rules. You clicking into the rules shows us nothing we can not see from just the port forward page.
-
My port forwards page was the first screenshot i posted. my ISP is not blocking any of the ports being used. The services all worked with my old router. Test websites say ports 22 and 32400 are visible but no others are. I'm sure this means I'm doing something wrong, but I don't know what. All of my port forwards and rules have been posted, because to me they all look like they've been configured identically, but maybe someone that's been using the software for much longer can spot an error. I posted the rules because KOM asked me to in an earlier post.
-
Hi,
What kind of device is connected to the WAN interface ?
How is your WAN interface set up ?edit Firewall > NAT > Outbound is set to automatic, right ?
-
Were is the Floating tab.. You can port forward all day long... But if they are not allowed on the wan... They don't work.
Your port forwards have ZERO hits for the rules that should be allowing them on the wan.. see the 0/0 To me that says nothing ever even got there..
The troubleshooting guide will have find your problem is like 2 minutes...But you can not even look further if you have not actually validated that pfsense even sees the traffic.
Port 666 is not being forwarded... (because I do not have it it open) But I can tell it gets to pfsense..
Follow the guide and you will find out the reason its not working in all of couple of minutes.
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.htmlI you see traffic get there on wan, then sniff on the lan side - do you see pfsense send it.. If so then firewall on the client device, wrong IP for the client device.. Device you forwarding to no using pfsense as its gateway. Or service your forwarding to is on different port, or not even running.
-
Update: my issues have been resolved
I changed the ports Apache and the minecraft server listen to and forwarded those ports and now everything works.
Thanks to everyone that contributed and gave advice
-
So did you ever validate that the traffic was actually getting to pfsense?
-
It seems like the traffic on ports 80 and 8080 was not getting to PFsense. I still don't know why those ports worked with the old Asus router but not PFsense. Anyway, the connection to the services is much more stable than before and I wouldn't switch back.
-
What is in front of pfsense? But those ports are quite often just plain blocked by some isps.. Especially the ones that per their AUP state you are not to run servers..
-
It's an Arris SB6141 modem
-
Well that is just a modem, it doesn't do any nat.. So if the ports not getting to you - it was done at the ISP level - which again is something they are quite able to do..
If you sniffed and the ports didn't get to pfsense - then no pfsense could not forward them.
