Would it be Forwarding or Outbound?

johnpoz

@o12eMaRkAbLeo lets see your outbound nat rules.. from the way I am reading those top too states your not using static.

Here I setup static outbound nat for my pc and went to something..

So see looking at some states you can see its doing normal napt.. Where the source port from my box on 192.168.9.100 is not the same as the source port coming from my wan..

I then change the nat to be static, and now "NEW" sessions I create the source is the same used on my wan as what my client sent it from..

So lets see your outbound static setup, and also you need to make sure you create a new session after you set it.. So you would want to kill all the old sessions..

edit: oh when I grabbed the before, I didn't limit it to the 9.100 box.. But you get the idea before the ports were changed. When I setup for 9.100 to do static outbound all his ports are the same.

o12eMaRkAbLeo

@johnpoz

Port Forwarding

Outbound NAT

Firewall rule created by Port Forwarding

Current states with settings

johnpoz

@o12eMaRkAbLeo well clearly that is not doing static port outbound.. And you killed all the states that were existing before you created that outbound not with static port setting?

Those settings look right at first glance, thanks for posting the screenshots.. much easier to read..

Hmmm

you don't have UPnP enabled do you? What version of pfsense are you on?

All your traffic from that device should be static port.. Can you make sure all your states were killed and then create outbound stuff to other stuff not just to that 34197 port.. Open some websites or something from something on your 192.168.10 network...

edit: your firewall rules are loading right when you click apply on that outbound nat setting.. Your hybrid mode I take it.. or I think those mappings wouldn't even be listed.

Can you look at your rules with

See there is the outbound at rule I created, it shows to my wan address, and has the static-port on it..

o12eMaRkAbLeo

This post is deleted!

o12eMaRkAbLeo

@johnpoz

I did have UPnP enabled. Just disabled it.. I really didn't have a need for I just turned it on a while back.

States after turning off UPnP

johnpoz

@o12eMaRkAbLeo that is odd..

edit: wait, I don't see your static nat in your rules when you do the pctrl -sn..

See mine, vs yours. Where is the static port to your wan like mine when created the static port outbound mapping?

If the rule is not there, then no it would never static port nat it.. So that would explain why your not seeing the static port nat, the rule isn't there, even though you show it in the gui.

You flushed all your states? Can you try creating a connection to something completely new like www.yahoo.com or cnn.com - www.msn.com somewhere you don't normally go?

I can not duplicate your problem here. What version of pfsense are you on?

Here so for example.. www.msn.com is

;www.msn.com.                   IN      A

;; ANSWER SECTION:
www.msn.com.            16383   IN      CNAME   www-msn-com.a-0003.a-msedge.net.
www-msn-com.a-0003.a-msedge.net. 1986 IN CNAME  a-0003.a-msedge.net.
a-0003.a-msedge.net.    1986    IN      A       204.79.197.203

So if I go there.. and look at my states to that IP, you can see the port leaving the wan has been changed. I close that browser tab and flush the states and create static port rule.. Then go there and now the port is static.

o12eMaRkAbLeo

@johnpoz

Is there a way to set the static mapping from the cli?

johnpoz

@o12eMaRkAbLeo what I would do is delete your mapping, save. then recreate the mapping save and apply.. then check your rules with the pfctl -sn cmd.. But its never going to do a static mapping if you don't see that in the rules.

o12eMaRkAbLeo

@johnpoz

NAT Outbound

This is what happened after making these changes.

johnpoz

@o12eMaRkAbLeo So those clearly are not actually being applied.

your in hybrid mode right.. Can you post the full screen of your outbound nat..

example here is mine.

I pulled out the static port map.. But from what you posted - your static port isn't being applied to the rules for some reason. When you hit apply your not seeing any errors?

Your not doing some sort of HA pair with a sync to another pfsense are you?

o12eMaRkAbLeo

@johnpoz

Here is the Outbound entry

No I have no HA setup just a single instance.

Here are my system specs

List of install and running packages

Here is my pcie SFP+ 10gb info

o12eMaRkAbLeo

Found this infromation in the rules.debug file.

Seems like the info is there but just not loading up when it goes through the file.

johnpoz

@o12eMaRkAbLeo so the rules are not actually reloading.. Did you try a force reload? Your not seeing any errors if you click the monitor the reload

o12eMaRkAbLeo

@johnpoz

How would I go about force reloading?

No I am not seeing any errors from the web gui after saving the settings.

johnpoz

@o12eMaRkAbLeo said in Would it be Forwarding or Outbound?:

force reloading?

under status, filter reload, you can then watch the load process, etc.

edit: also since know your on 2.7.1 and I am on 23.09 I fired up my 2.7.1 to see if could duplicate your problem.. And works just like it should.. You can no outbound rule.. Then created a rule, and its there when I use pfctl -sn

o12eMaRkAbLeo

@johnpoz

Just did a "pfctl -F all" and rebooted. No change.

johnpoz

@o12eMaRkAbLeo so your able to add other rules and port forwards.. Can you remove all your port forwards...

Your just not able to create a static port.. So create some sort of other rule just on your lan or wan interfaces.. And they get added when you look at the full rules.

https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

You just can not set a static outbound?

Calling in @stephenw10 maybe he has some idea.. I can not reproduce it that is for sure, not on my 23.09 or my 2.7.1 vm.

edit: example - just created a bogus rule on my lan, and if I look at all my rules with the pfctrl -sr I see that rule added

DUDE!!!! You have the rule disabled!!!???

If you I disable a rule, it goes grey

But that doesn't show up on yours?? Something is for sure off.. I tried changing my theme to dark and dark-beta, but if I disable the rule it puts a checkmark.. But from your post sure looks like the rule is disabled?? But its not a checkmark and the rule isn't greyed out going to an X, so it should be active.. But its not in your full rule list, which would explain why its not working..

I am really at a loss to what could be going on.. You can created other rules and they show up in the pfctl right? See my test from above.

o12eMaRkAbLeo

@johnpoz

No. The rule is not disabled.

But also the new rule that I put on .11 isn't showing up in the pfctl output either.....

New rule

Pfctl -sn output

johnpoz

@o12eMaRkAbLeo no just create a normal rule on some other interface.. The rule doesn't really have to do anything actually, it never has to trigger just want to see if your having this issue with all rules or just outbound nat..

See how I created a dummy rule that would never trigger on my lan because there a any any rule above it.. But when I create it shows up in the rules via the pfctl cmd

Looks like for some reason your not actually in hybrid mode, and only your automatic rules are showing.

o12eMaRkAbLeo

@johnpoz

I have already done that I think yesterday.

The .11 isn't showing up in the pfctl -sn output. That is why I decided to build the rule to allow static porting on ipv6 to see if it would show up in the output. It is but still not accepting the static routing.

Assigned another network port to LAN2

pfctl -sn output after changes