Port forward for Steam
-
I have a windows server that has Steam server software that needs to have a port opened to work and for some reason its not working at all. I have verified that the service provider is not the issue. I have played with the rules for hours and im just stuck. Just to make sure the server wasn't the issue I disabled the firewall with no luck. Please see the attached screenshots and hopefully, someone can see if I made a mistake. also as an FYI the windows system is on a VLAN (15). Thank you!!
-
-
@natethegreat21 your wanting to host a game on that 7779 port?
I don't show steam needing any inbound ports open
https://help.steampowered.com/en/faqs/view/2EA8-4D75-DA21-31EBIf your trying to port forward 7779 to your machine on 192.168.150.3 why would you have the firewall rule set to ! 192.168.50.3 - that is saying you can go to any IP other than that IP.
If you just let the port forward create the associated rule it would do it correctly.
Also why would you setup an outbound nat for destination of that port source to be same 7779? That is almost never correct. Source port would be any. There would be no outbound nat needed for a port forward.
Also why are you trying to setup a pure nat for nat reflection? Nat reflection is only needed if your client behind pfsense is trying to access pfsense wan IP to get to a local resource.
-
@johnpoz Thank you for your response! I am hosting a game server that other players will connect to so it needs that port open according to them. I have unchecked the "Invert match" box. I have also disabled NAT reflection.I rechecked the a few port checker websites off my phone on cellular and its still saying the ports are closed for some reason.
-
@natethegreat21 Well lets see your port forwards and your wan rules.
First step is always validate traffic is getting to you - simple packet capture on your wan while you go to say can you see me . org
Here created a port forward for 7779, even though my machine isn't listening on this port, very simple to verify getting to my wan, and being sent on to my lan device.
You can see my port forward and wan rule.
Went to can you see me sent traffic to that port. I can see it on my wan packet capture, and I can see that it sent it on to my lan device on 192.168.9.100 - it sent back a RST.. Saying hey nothing here on that port
-
@johnpoz Okay I set everything up like you have in the screen shots and did a packet capture and I see the request coming from the server to the WAN IP and when I check the LAN side nothing is being captured for that port.
-
@natethegreat21 well then something wrong with your port forward, if your saying when you sniff on the lan, and your not seeing any traffic to that IP you setup your forward to.
But you see it hit your wan IP on that port..
Could be pfsense can not even talk to that IP, pfsense can not send the traffic if there is no mac in the arp table for that IP.
Maybe you have a floating rule that blocking the port forward..
Use the port tester in pfsense.
Here I tested port to IP on my lan, that I know it open.. But I don't forward to it - but you can see pfsense was able to talk to it.
Did you capture on the right lan side interface, do you have this setup on a vlan? Happy to help you but without specific details, just guessing to what you have incorrect or wrong, or would could be stopping it from working.
-
@johnpoz the IP is on VLAN 15 and when I tested the port it failed. I have also attached the floating rules which were stup to prevent the VLANs from talking to the firewall
-
@natethegreat21 well from that test, you know for sure that even if pfsense can talk to that IP - its not listening on that port, or sending a RST.
Can pfsense even ping the IP? Look in the arp table - do you see mac listed for that IP?
-
@johnpoz Yes I see the MAC and IP listed.
-
@natethegreat21 well clearly the box is not working on 7779..
So doesn't matter if pfsense port forward working or not, its not going to work if the port is not listening on the port.
You sure that is the IP is your game is running on, look via netstat on the machine and validate 7779 is actually listenging..
For example you can see on my nas that its listening on that 5001 I tested too
ash-4.4# netstat -an | grep :5001 tcp 0 0 0.0.0.0:5001 0.0.0.0:* LISTEN tcp6 0 0 :::5001 :::* LISTEN ash-4.4#netstat works on windows as well
$ netstat -an Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP 0.0.0.0:445 0.0.0.0:0 LISTENING TCP 0.0.0.0:2008 0.0.0.0:0 LISTENING TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING TCP 0.0.0.0:6045 0.0.0.0:0 LISTENING TCP 0.0.0.0:28525 0.0.0.0:0 LISTENING TCP 0.0.0.0:31111 0.0.0.0:0 LISTENING TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING -
@johnpoz So I see the port there under UDP but it does not say its listening for some reason.
-
@natethegreat21 well if its not listening that would explain why you can not talk to it
But that wouldn't explain why you didn't see it send on the traffic. But until you can see it listening and the port tester validates the port is up and pfsense can talk to it. doesn't matter if your port forward is working or not.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
@johnpoz I looked on the windows machine to see of the ports were listening and they didn't say they were its showed its there but it didn't have the listening next to it. I did notice that I can ping the 192.168.150.1 but not the 192.168.150.3
-
@johnpoz I don't usually have this many issue with port forwarding so not really sure what the next step would be at this point. Got any suggestions please?
-
@natethegreat21 I will also note that this windows machine is a VM
