Port forwarding - firewall log accepts packet, nothing in state table.

  • I am attempting to port forward UDP port 9001 to an inside address of, I have one static IP for my WAN interface. There are two internet hosts that need to connect to the inside NAT, both on UDP port 9001 that I noticed an entry in the firewall log accepting one host (HOST A), but the state table showing a connection for the other (HOST B). What am I doing wrong here?

    NAT rule:
    If  Proto  Ext. port range  NAT IP  Int. port range 
    WAN UDP 9001 9001

    Firewall rule:
    Proto  Source  Port  Destination  Port  Gateway 
    UDP           *         * 9001 *

    What I see in the firewall logs:

    HOSTA = @79 pass in log quick on bce1 inet proto udp from any to port = 9001 keep state label "USER_RULE: NAT "
    no log entry for HOSTB

    What I see in the state table:

    udp <- WANIP:9001 <- HOSTB:9001  MULTIPLE:MULTIPLE
    udp -> WANIP:27222 -> HOSTA:9001  SINGLE:NO_TRAFFIC

  • I realized that I did not have outbound NAT static mapping the UDP ports, and appears all is well now that I enabled outbound manual NAT. I had to open all other ports to NAT as well (any to any) at the bottom of my NAT entries to get everything to work.

Log in to reply