Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Nothing gets through except Plex

    Scheduled Pinned Locked Moved Firewalling
    19 Posts 4 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      confuzednoob
      last edited by

      I recently switched from an Asus wireless router to a PFsense machine, and while using the Asus device all of my services were accessible from outside the LAN. Friends could use my Minecraft server, Plex worked from anywhere, and I could access my webpage from work, etc.

      Since switching to PFsense I get much better speed for internet connections, but the only service that I can access from outside of my house is Plex for some reason. I still use the old Asus router as a wireless access point. I've assigned my devices the same static IPs they had on my old router and can access the services from inside my house just fine.

      I have set up port forwarding rules for everything and cannot figure out why Plex is accessible but nothing else is. Canyouseeme.org says connections to 25565 are refused, and connections to ports 80 and 8080 time out.

      I'd greatly appreciate some insight into how to fix this

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        Post screens of your WAN rules and NAT port-forwards. Obscure any public details like your WAN IP address, for example.

        1 Reply Last reply Reply Quote 1
        • C
          confuzednoob
          last edited by confuzednoob

          List.png

          8080.png

          80 to 8080.png

          Plex.png

          Minecraft.png

          SSH.png

          Edit: uploaded the screenshots

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by KOM

            You can post images here directly. Look for the Upload Image button on the far-right of the Edit bar.

            I didn't see your WAN rules in the list of screens. Normally, an associated firewall rule gets created on WAN to allow the NAT'd traffic, and I wanted to check that it was there. Otherwise your NATs look good and things should work.

            https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

            1 Reply Last reply Reply Quote 1
            • C
              confuzednoob
              last edited by

              I'll post the list of WAN rules after work. Thanks for taking time to help

              1 Reply Last reply Reply Quote 0
              • C
                confuzednoob
                last edited by

                WanRules.png

                Plex WAN.png

                Minecraft.png

                apache WAN pt 8080.png

                I've noticed that both Apache rules look identical, despite port forwarding needing to NAT port 80 to 8080. I might not have set the port forwards for that correctly.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  And you can see from you rules that your rules that are not working have zero hits.. Means pfsense never saw the traffic...

                  I have been using pfsense for 10 years.. And in the 10 years I have been using it, and on this forum - not once have I seen an issues with port forwarding that was not user error.. This is not rocket science.. You forward the port - the traffic gets to pfsense it sends it on..

                  Here.
                  https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html

                  Step one in port forwarding is validate that pfsense is actually seeing what your wanting to forward... It takes all of 10 seconds to sniff and hit up can you see me . org to validate your traffic actually gets to pfsense for it to forward.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • C
                    confuzednoob
                    last edited by

                    I've uploaded the screenshots to my second post here. I'm just here to learn how to use the software, not to criticize it. I used canyouseeme before my initial post. SSH and plex are visible, yet despite being configured in nearly an identical way, Apache times out and the minecraft port's connection is refused. These services all work locally, so I'm just confused, as my username implies.

                    1 Reply Last reply Reply Quote 1
                    • KOMK
                      KOM
                      last edited by

                      Your ISP may be blocking incoming traffic to those ports. Run a packet capture on WAN (Diagnostics - Packet Capture) and then try your tests from the WAN side. Stop the capture and see if pfSense sees the traffic at all. That will confirm if it's being blocked upstream.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        And again - it takes all of 10 seconds to actually validate the traffic is getting to you... This is always going to be step one.. Pfsense can not forward what it doesn't see.,

                        Use can you see me . org - sniff...

                        Do you see this traffic get to pfsense? Not sure what you think how those screen shots would help... We need to see 2 screen shots.. Your actual port forward page, and the wan firewall rules. You clicking into the rules shows us nothing we can not see from just the port forward page.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • C
                          confuzednoob
                          last edited by

                          My port forwards page was the first screenshot i posted. my ISP is not blocking any of the ports being used. The services all worked with my old router. Test websites say ports 22 and 32400 are visible but no others are. I'm sure this means I'm doing something wrong, but I don't know what. All of my port forwards and rules have been posted, because to me they all look like they've been configured identically, but maybe someone that's been using the software for much longer can spot an error. I posted the rules because KOM asked me to in an earlier post.

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan
                            last edited by Gertjan

                            Hi,

                            What kind of device is connected to the WAN interface ?
                            How is your WAN interface set up ?

                            edit Firewall > NAT > Outbound is set to automatic, right ?

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Were is the Floating tab.. You can port forward all day long... But if they are not allowed on the wan... They don't work.

                              Your port forwards have ZERO hits for the rules that should be allowing them on the wan.. see the 0/0 To me that says nothing ever even got there..

                              The troubleshooting guide will have find your problem is like 2 minutes...But you can not even look further if you have not actually validated that pfsense even sees the traffic.

                              Port 666 is not being forwarded... (because I do not have it it open) But I can tell it gets to pfsense..

                              gotthere.jpg

                              Follow the guide and you will find out the reason its not working in all of couple of minutes.
                              https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html

                              I you see traffic get there on wan, then sniff on the lan side - do you see pfsense send it.. If so then firewall on the client device, wrong IP for the client device.. Device you forwarding to no using pfsense as its gateway. Or service your forwarding to is on different port, or not even running.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • C
                                confuzednoob
                                last edited by

                                Update: my issues have been resolved
                                I changed the ports Apache and the minecraft server listen to and forwarded those ports and now everything works.
                                Thanks to everyone that contributed and gave advice

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  So did you ever validate that the traffic was actually getting to pfsense?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    confuzednoob
                                    last edited by

                                    It seems like the traffic on ports 80 and 8080 was not getting to PFsense. I still don't know why those ports worked with the old Asus router but not PFsense. Anyway, the connection to the services is much more stable than before and I wouldn't switch back.

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      What is in front of pfsense? But those ports are quite often just plain blocked by some isps.. Especially the ones that per their AUP state you are not to run servers..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        confuzednoob
                                        last edited by

                                        It's an Arris SB6141 modem

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          Well that is just a modem, it doesn't do any nat.. So if the ports not getting to you - it was done at the ISP level - which again is something they are quite able to do..

                                          If you sniffed and the ports didn't get to pfsense - then no pfsense could not forward them.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.