Would it be Forwarding or Outbound?

o12eMaRkAbLeo

I have a situation trying to host Factorio headless server.

Port Forwarding:
Interface: WAN
Protocol: UDP
Des: WAN address
Des Port: 34197
Redirect: internal address of the server
Red port: 34197
NAT reflection: System Default
and yes I have a rule association created

Outbound:
Hybrid
Interface: WAN
Protocol: UDP
Source: internal address of the server
Port: 34197
Des: WAN address
Des Port: "blank"

Translation:
Address: WAN address
Port: Static Port "Checked"

States:
WAN udp <exteranl_ip>:35027 (192.168.10.9:34197) -> 172.104.241.28:34197
WAN udp <exteranl_ip>:36092 (192.168.10.9:34197) -> 45.79.173.216:34197
LAN udp 192.168.10.9:34197 -> 172.104.241.28:34197
LAN udp 192.168.10.9:34197 -> 45.79.173.216:34197

Can someone please help me figure out what setting I need to change?

SteveITS

@o12eMaRkAbLeo If you're trying to port forward, there is no need for an outbound NAT rule. Other than that I gather something isn't working. Are you testing from the Internet?

https://docs.netgate.com/pfsense/en/latest/troubleshooting/nat-port-forwards.html

johnpoz

@o12eMaRkAbLeo from their wiki, looks like you would want to set a static nat for outbound

https://wiki.factorio.com/Multiplayer

Make sure your router does not randomize the source port on packets outbound from 34197. Some routers do this and require additional configuration to prevent it.

https://docs.netgate.com/pfsense/en/latest/nat/outbound.html#static-port

They should update their link for to what they were wanting to link too some old pfsense forum thread back when it was using pfsense.org vs netgate.com for the forum.

edit: from this these states you posted

WAN udp <exteranl_ip>:35027 (192.168.10.9:34197) -> 172.104.241.28:34197
WAN udp <exteranl_ip>:36092 (192.168.10.9:34197) -> 45.79.173.216:34197

Your not doing static outbound, so your 10.9 talked from source of 34197 but got changed to port 35027 and 36092.. From their wiki looks like they want the traffic to come from port 34197 so that would be static outbound nat.. See link.

o12eMaRkAbLeo

@SteveITS I'm running a headless server so I have to outbound the game port

o12eMaRkAbLeo

@johnpoz I have the static port box checked. That is why I am confused and asking for help.

johnpoz

@o12eMaRkAbLeo lets see your outbound nat rules.. from the way I am reading those top too states your not using static.

Here I setup static outbound nat for my pc and went to something..

So see looking at some states you can see its doing normal napt.. Where the source port from my box on 192.168.9.100 is not the same as the source port coming from my wan..

I then change the nat to be static, and now "NEW" sessions I create the source is the same used on my wan as what my client sent it from..

So lets see your outbound static setup, and also you need to make sure you create a new session after you set it.. So you would want to kill all the old sessions..

edit: oh when I grabbed the before, I didn't limit it to the 9.100 box.. But you get the idea before the ports were changed. When I setup for 9.100 to do static outbound all his ports are the same.

o12eMaRkAbLeo

@johnpoz

Port Forwarding

Outbound NAT

Firewall rule created by Port Forwarding

Current states with settings

johnpoz

@o12eMaRkAbLeo well clearly that is not doing static port outbound.. And you killed all the states that were existing before you created that outbound not with static port setting?

Those settings look right at first glance, thanks for posting the screenshots.. much easier to read..

Hmmm

you don't have UPnP enabled do you? What version of pfsense are you on?

All your traffic from that device should be static port.. Can you make sure all your states were killed and then create outbound stuff to other stuff not just to that 34197 port.. Open some websites or something from something on your 192.168.10 network...

edit: your firewall rules are loading right when you click apply on that outbound nat setting.. Your hybrid mode I take it.. or I think those mappings wouldn't even be listed.

Can you look at your rules with

See there is the outbound at rule I created, it shows to my wan address, and has the static-port on it..

o12eMaRkAbLeo

This post is deleted!

o12eMaRkAbLeo

@johnpoz

I did have UPnP enabled. Just disabled it.. I really didn't have a need for I just turned it on a while back.

States after turning off UPnP

johnpoz

@o12eMaRkAbLeo that is odd..

edit: wait, I don't see your static nat in your rules when you do the pctrl -sn..

See mine, vs yours. Where is the static port to your wan like mine when created the static port outbound mapping?

If the rule is not there, then no it would never static port nat it.. So that would explain why your not seeing the static port nat, the rule isn't there, even though you show it in the gui.

You flushed all your states? Can you try creating a connection to something completely new like www.yahoo.com or cnn.com - www.msn.com somewhere you don't normally go?

I can not duplicate your problem here. What version of pfsense are you on?

Here so for example.. www.msn.com is

;www.msn.com.                   IN      A

;; ANSWER SECTION:
www.msn.com.            16383   IN      CNAME   www-msn-com.a-0003.a-msedge.net.
www-msn-com.a-0003.a-msedge.net. 1986 IN CNAME  a-0003.a-msedge.net.
a-0003.a-msedge.net.    1986    IN      A       204.79.197.203

So if I go there.. and look at my states to that IP, you can see the port leaving the wan has been changed. I close that browser tab and flush the states and create static port rule.. Then go there and now the port is static.

o12eMaRkAbLeo

@johnpoz

Is there a way to set the static mapping from the cli?

johnpoz

@o12eMaRkAbLeo what I would do is delete your mapping, save. then recreate the mapping save and apply.. then check your rules with the pfctl -sn cmd.. But its never going to do a static mapping if you don't see that in the rules.

o12eMaRkAbLeo

@johnpoz

NAT Outbound

This is what happened after making these changes.

johnpoz

@o12eMaRkAbLeo So those clearly are not actually being applied.

your in hybrid mode right.. Can you post the full screen of your outbound nat..

example here is mine.

I pulled out the static port map.. But from what you posted - your static port isn't being applied to the rules for some reason. When you hit apply your not seeing any errors?

Your not doing some sort of HA pair with a sync to another pfsense are you?

o12eMaRkAbLeo

@johnpoz

Here is the Outbound entry

No I have no HA setup just a single instance.

Here are my system specs

List of install and running packages

Here is my pcie SFP+ 10gb info

o12eMaRkAbLeo

Found this infromation in the rules.debug file.

Seems like the info is there but just not loading up when it goes through the file.

johnpoz

@o12eMaRkAbLeo so the rules are not actually reloading.. Did you try a force reload? Your not seeing any errors if you click the monitor the reload

o12eMaRkAbLeo

@johnpoz

How would I go about force reloading?

No I am not seeing any errors from the web gui after saving the settings.

johnpoz

@o12eMaRkAbLeo said in Would it be Forwarding or Outbound?:

force reloading?

under status, filter reload, you can then watch the load process, etc.

edit: also since know your on 2.7.1 and I am on 23.09 I fired up my 2.7.1 to see if could duplicate your problem.. And works just like it should.. You can no outbound rule.. Then created a rule, and its there when I use pfctl -sn