NAT not working to an specfic IP/Port

hugoeyng

Hello, Friends.

I setup a NAT as following:

A filter rule was associtade automaticly, to passa traffic.

When I try to test/scan port, it appears "closed".

I can not access the resource that is installed on my internal IP listining the redirect target port.

What should I look for?

johnpoz

@hugoeyng

https://docs.netgate.com/pfsense/en/latest/troubleshooting/nat-port-forwards.html

First step I would suggest is simple sniff on your infix interface (packet capture diag menu).. Then go to say can you see me . org and test to this 25001 port.. Do you see the traffic hit pfsense on this 25001 port..

Because if the traffic isn't even getting to pfsense, there is nothing you can do to make it work - so this is the first thing you should actually validate.

JonathanLee

@hugoeyng check out it’s placement on the firewall ACL list it should have added a new rule, I am sure you know they run in sequential order. So if you have a block above your new rule that might cause it. NAT rule will auto generate a firewall rule as well.

hugoeyng

@JonathanLee Thank you for your answer.

I put the rule in the top of both WAN´s

Monitoring in Diagnostics/Package Capture has no traffic logged.

I obsrerved that if I check port open ( ca you see me) for VPN ports, the answere is the same: Error: I could not see your service on nnn.nnn.nnn.nnn on port (1194), even than I use VPN from external IP´s.

It looks like I have no access to any port, but I acctually have.

The only port showing as open is 443, and I guess that is because I set User GUI to https. Iam not sure, of course.

johnpoz

@hugoeyng said in NAT not working to an specfic IP/Port:

your service on nnn.nnn.nnn.nnn on port (1194

Well that is most likely UDP.. can you see me only sends tcp.

Your 25001 port seems to have seen some traffic on that CLARO interface as some point.

mcury

@hugoeyng said in NAT not working to an specfic IP/Port:

I obsrerved that if I check port open ( ca you see me) for VPN ports, the answere is the same: Error: I could not see your service on nnn.nnn.nnn.nnn on port (1194), even than I use VPN from external IP´s.

That won't work, openVPN is UDP, and that site checks TCP.

@hugoeyng said in NAT not working to an specfic IP/Port:

It looks like I have no access to any port, but I acctually have.

You say that because openVPN is working, right ?

@hugoeyng said in NAT not working to an specfic IP/Port:

The only port showing as open is 443, and I guess that is because I set User GUI to https. Iam not sure, of course.

I wouldn't leave that open, never. Manage pfSense through a VPN.

You configured INFIX's modem to portforward openVPN port to your pfsense, and forgot to do the same with that TCP port 25001.
If this is the problem, you should configure that port, or put the pfsense's interface INFIX IP address in the INFIX modem's DMZ.
Or, even better, configure that modem in bridge mode.

hugoeyng

@johnpoz I installed a reverse proxy.

JonathanLee

@hugoeyng I agree you got to use UDP for open vpn port 1194 change the protocol from tcp to udp

viragomann

@hugoeyng
Obey @johnpoz suggestion and sniff the traffic using Diagnostic > Packet Capture on pfSense.

Select the INFIX interface and state 25001 at the port filter. Start the capture and then try to check the port with canyouseeme or alike from outside.

If there are no packets, something is wrong in front of pfSense.
If you see incoming packets, but no responses, go the internal interface, where the destination server is connected to.