pfsense ce 2.7.2 configured with port forwarding, packet drops randomly (pfsenseplus looks like work)
-
I configured port forwarding rules for our application, to allow the client access this application, we need allow 3 tcp and 4 udp ports
then we lauched the connections, but most time it will be failed to connect only few of chance we can connect through.
I capture network logs on pfsense and client at the same time, from logs on client side i found many retransmit and cause the connection stopped, while i checked logs on pfsense, i found syn/syc+ack, but looks like tcp packet didn't hit on wan interface
i did lots of tuning, such as re-install pfsense ce, enlarge the spec(cpu/mem), tuning parameters, but the same not work
we did the same on pfsense plus (23.09), looks like it works on pfsense plus.
so my question is:
1、is it possible known issue/bug for this case?
2、how should i trouble shoot further for this kind of issue; in another word, how could i check confirm where and how the packet drop?Thanks much for your help!
-
@allenlwli said in pfsense ce 2.7.2 configured with port forwarding, packet drops randomly (pfsenseplus looks like work):
but looks like tcp packet didn't hit on wan interface
If packets don't hit = arrive (right ?) at the pfSense WAN gate, your pfSense issues is solved, as the issue is upstream.
Not sure what this is :
but for classic port and addresses NATing I never hat to take that setting from 'default'.
-
@Gertjan
thank you much for your help
For NAT reflection, even we tried to use options like system default/disbaled/pure NAT, the same not workingThe thing is if I switch to use pfsense plus (23.09), which is under same subnet as pfsense CE, then the connectivity will be good;
I am a little bit suspect there is ongoing bug with pfsense CE -
This post is deleted! -
i finally found the cause, i changed the 'Filter Rule association' from 'pass' to other, i then works
but the thing is we have default gateway and even i allow all in firewall rule, but nat with filter rule association 'pass', nat still not forward the traffic; looks like it's the bug of pfsense
