Can somebody help me get to Yamaha YNCA throug a pfSense?

chpalmer

@Mastiff This might help you-

https://forum.netgate.com/topic/139218/sonos-speakers-and-applications-on-different-subnets-vlan-s

Mastiff

@chpalmer Thanks, but that is not the same case. I tried it, but it doesn't work. I think it's because that 's between two VLANs on the same pfSense, I need to get it from WAN to LAN.

Mastiff

OK, weirder... According to the Plug-in programmer it's a simple TCP socket connection to port 50000 on the reciever. So then I really don't undrestand why I can't connect!

stephenw10

The plugin is supposed to connect out to the receivers? Or the receivers send data to the plugin?

If the the protocol is crude you might need to set static outbound NAT for port 50000. The receivers may not allow random source ports. Assuming pfSense is still NATing from LAN to WAN.

Mastiff

@stephenw10 Thanks for answering! As far as I understand, the plug-in connects to the receiver on 50000 and gets back data on the same port. I have now tried to add an static outbound NAT, but it still doesn't work. Does the rule here seem right? And should I add a Firewall rule as well?

viragomann

@Mastiff said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

According to the Plug-in programmer it's a simple TCP socket connection to port 50000 on the reciever. So then I really don't undrestand why I can't connect!

Maybe one of the involved devices doesn't have a gateway set, or even doesn't have an option for that.
In this case you could nat the traffic to pfSense interface address with an outbound NAT rule.

@Mastiff said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

As far as I understand, the plug-in connects to the receiver on 50000 and gets back data on the same port. I have now tried to add an static outbound NAT

Why on WAN?
You need the rule on the interface, which the receiver is connected to. I'm in doubt, it is on the WAN.

stephenw10

Change the source to only the LAN subnet or only the HA IP specifically. You don't want to over match.

Change the source port to 'any' It may bot be using port 50000 as source.

Try checking the state table to see what ports the HA plugin is actually using.

Try a pcap on the WAN side to see if there's any reply traffic.

Mastiff

@viragomann You obviously did not read the first post about this setup before you started to doubt that it is on the WAN. It is. If you read the first post you will understand why. Btw I ride a Honda Blackbird.

@stephenw10 I changed those, but will having nothing in Source Port or Range make it any? The word any is not possible there.

stephenw10

Yes leave it empty to match any source port.

Mastiff

@stephenw10 Here are the states:

And the packet capture, it ran for some seconds before I tried to connect Hass to it:

packet capture Hass Yamaha plug-in.txt

I think this may be the most important stuff, since WAN on my Hass is 192.168.1.53:

14:44:40.749486 IP 192.168.1.53.54230 > 192.168.1.200.50000: tcp 0
14:44:40.750059 IP 192.168.1.200.50000 > 192.168.1.53.54230: tcp 0
14:44:40.750341 IP 192.168.1.53.54230 > 192.168.1.200.50000: tcp 0
14:44:40.753188 IP 192.168.1.53.54230 > 192.168.1.200.50000: tcp 18

Edit: I tried to make a Port Forward NAT rule from WAN to 192.168.6.2 (the IP of the Hass VM), with 54230 as the port, but that did not help.

tinfoilmatt

@Mastiff said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

I tried to make a Port Forward NAT rule from WAN to 192.168.6.2 (the IP of the Hass VM), with 54230 as the port, but that did not help.

NAT rules do not determine nor cause ports to be used by network hosts. NAT rule parameters merely specify which parameters (i.e., interface, IP version, protocol, [source IP]:[source port], and [destination IP]:[destination port]) the rule will 'act' on.

viragomann

@Mastiff said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

You obviously did not read the first post about this setup before you started to doubt that it is on the WAN.

Sure, I've read it. But this was yesterday and my brain is aged.

Okay, the receiver is connected to WAN. So pfSense already nats the traffic to it, since your outbound NAT is in hybride mode.

Btw I ride a Honda Blackbird.

But Honda doesn't build AV receivers.

Mastiff

@tinfoilmatt I am aware of that. But it seems like the receiver is trying to contact back on 54230.

@viragomann No, you're right. Only Yamaha does both that and motorcycles. I used to have an RD350 two stroke some years ago. And the problem (at least if I understand the packet capture) is not that Hass can't contact the receiver, it's that the receiver can't contact back.

tinfoilmatt

@Mastiff said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

I am aware of that. But it seems like the receiver is trying to contact back on 54230.

You can't be aware of what I said if that's your response. The receiver's 'network stack' is apparently programmed to use a range of TCP source ports (presumably somewhere within, but potentially not exclusive to, a 52[xxx]-54[xxx] range).

Stephen's advice already accounted for anything your attempting to address on this specific point by suggesting you use a source port ANY/* in your "NAT til Yamaha-forsterkere" NAT rule.

johnpoz

@Mastiff said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

is not that Hass can't contact the receiver, it's that the receiver can't contact back.

If you allow traffic out - the return traffic is always allowed back via the state.

Only time you would need a port forward is if something on your wan was trying to initiate traffic.

That you have stuff on your "wan" is curious - why would your stuff not just be on another segment behind pfsense.

tinfoilmatt

Something about using RFC1918 on both the WAN and LAN interfaces may require particular static routing and/or reconfiguration of pfSense settings (e.g., Interfaces / WAN / Block private networks and loopback addresses).

Mastiff

@johnpoz As I said in my first message, this is a pfSense on my "outer" LAN, which is defined as WAN in it, that routes traffic to Home Asistant, and only the traffic I want there. So it's not a real WAN.

@tinfoilmatt I have already removed the tick in "Block private networks". And this one plug-in is the only thing that has problems, MQTT, SCRAPE sensors on port 8880-8889 and about ten other services and maybe 50 devices have no problems getting back and forth. Which is why I am not understanding this at all.

tinfoilmatt

@Mastiff Can you show your packet capture settings?

tinfoilmatt

And what's your 'outer' firewall/gateway? On the 192.168.1.0/24 network I mean. Also pfSense? I think you're going to need a static route configured on whatever that gateway is, directing traffic destined for the 192.168.6.0/24 subnet to use gateway 192.168.1.53.

(This topology is terribly designed by the way.)

patient0

@tinfoilmatt said in Can somebody help me get to Yamaha YNCA throug a pfSense?:

I think you're going to need a static route configured on whatever that gateway is, directing traffic destined for the 192.168.6.0/24 subnet to use gateway 192.168.1.53

Since pfSense is NAT-ing the .6.x traffic to the 192.168.1.x address of pfSense WAN that should not be necessary.