Firewall blocks ports after a certain time
-
I have set up two port forwardings. These work so far.
This port forwarding has automatically added two rules.
When I do a portscan on my public IP, I see that the ports are open.
For a few days or even a few weeks everything works perfectly. But suddenly the ports are blocked. In the firewall state table there are no more connections and the port scan on my public IP also shows that the ports are closed.
Does anyone have any idea what this could be or how I should debug this?
-
@mrremo said in Firewall blocks ports after a certain time:
the port scan on my public IP
Just to be sure : the WAN IP you use to check is still your WAN IP ?
Here is a tool (image of a tool, fire up Google to find it) https://forum.netgate.com/topic/178966/problems-with-nat/5?_=1679583290537 so you can double check your ports.
When checking, and traffic arrive 'at the gate', these counters
start to increment.
If not, traffic never even reached (the WAN interface of) pfSense. -
@gertjan said in Firewall blocks ports after a certain time:
Just to be sure : the WAN IP you use to check is still your WAN IP ?
Yes, I am sure that I am scanning the correct IP. It is a static public IP.
If the portscan says that the ports are closed, then the counters are not incremented.
-
@mrremo and what fixes it - does it just start working again.
Is it possible your destination box that 192.168.0.2 is changing Ips, or service(s) are stopping?
Whenever you have an issue with port forwarding - its always good to troubleshoot it just like you would when trying to set it up. Validate traffic is actually getting to your wan - your can you see me and packet capture on wan, and then lan interface - if pfsense sends on the traffic - but no response then you know its something downstream of pfsense.
-
@johnpoz said in Firewall blocks ports after a certain time:
@mrremo and what fixes it - does it just start working again.
So far only a reboot has helped.
@johnpoz said in Firewall blocks ports after a certain time:
Is it possible your destination box that 192.168.0.2 is changing Ips, or service(s) are stopping?
The IP is also a static one. So no, it has not changed. The service is running. It is accessible on the LAN. I am sure that the problem is not with the server (192.168.0.2), because the VPN port is also blocked. The VPN server is running on the pfSense box.
@johnpoz said in Firewall blocks ports after a certain time:
Validate traffic is actually getting to your wan
The next time the problem occurs, I will double-check.
