Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Portfowarding not working

    Scheduled Pinned Locked Moved NAT
    28 Posts 3 Posters 8.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      swordsaintx
      last edited by

      i have a red and green interface. on the red i have 5 virtual ips 3 are mapped too my 3 servers one is ispconfig, one zimbra and the other is secondary dns server. i use port forwarding to enable traffic to my servers and i enabled NAT Reflection but i cant see my sites and when i do a dns test with checkdns.net it says none of my name severs responded, even when  i use dig on one of my dns severs i get the same message. i dont know whats going on. ???

      WAN TCP/UDP 53 (DNS) 192.168.1.123
      (ext.: 67.40.148.249) 53 (DNS)

      WAN TCP/UDP 53 (DNS) 192.168.1.119
      (ext.: 67.40.148.250) 53 (DNS)  
      [edit rule]

      1 Reply Last reply Reply Quote 0
      • Cry HavokC
        Cry Havok
        last edited by

        You need to resolve your DNS problem first.

        Are you using a hosted DNS service, or are you trying to run your own DNS servers?  Can you post your domain name?

        1 Reply Last reply Reply Quote 0
        • S
          swordsaintx
          last edited by

          im running my own name servers they worked before on my ipcop router. my domain is dial4tech.com

          1 Reply Last reply Reply Quote 0
          • Cry HavokC
            Cry Havok
            last edited by

            You seem to be running the DNS on 2 name servers - 67.40.148.249 and 67.40.148.250.  From the WhoIS it looks like you are trying to run a DNS server on your home Internet connection?  If so you must have static IP addresses.

            Did you remember to forward port 53 (TCP and UDP) to your DNS servers?

            1 Reply Last reply Reply Quote 0
            • S
              swordsaintx
              last edited by

              yes i have two dns severs and i have 5 static ips two are used for the dns servers. yes i enabled tcp/udp

              1 Reply Last reply Reply Quote 0
              • Cry HavokC
                Cry Havok
                last edited by

                Can you post:

                • A diagram of your network, with IP ranges

                • A screenshot of the port forward rules

                • A screenshot of the WAN interface rules

                • A screenshot of the rules for the interface the DNS servers are on

                • Confirmation that the DNS servers can reach the Internet

                1 Reply Last reply Reply Quote 0
                • S
                  swordsaintx
                  last edited by

                  here is my network diagram
                  http://www.gliffy.com/pubdoc/2123917/L.png

                  portfowarding rules
                  http://i1008.photobucket.com/albums/af204/sinnersaintx/pfsenseoopenwirelessnet-Firewall-NA.png

                  firewall rules

                  Both server can ping yahoo.com

                  1 Reply Last reply Reply Quote 0
                  • Cry HavokC
                    Cry Havok
                    last edited by

                    Nothing obviously wrong there.

                    It would be worth checking (tcpdump/wireshark) to see if the packets are reaching your DNS servers and if they aren't to see if they are reaching your pfSense host.

                    1 Reply Last reply Reply Quote 0
                    • S
                      swordsaintx
                      last edited by

                      i dont see any  dns traffic. when i open it with wireshark it says no pakets.

                      1 Reply Last reply Reply Quote 0
                      • K
                        kpa
                        last edited by

                        Nvm, I missed that you are testing your servers with an external tool…

                        1 Reply Last reply Reply Quote 0
                        • S
                          swordsaintx
                          last edited by

                          i have nat refection unchecked. why do i need split DNS  if i have my own name servers?

                          1 Reply Last reply Reply Quote 0
                          • Cry HavokC
                            Cry Havok
                            last edited by

                            So, run tcpdump on pfSense - then you'll see if the packets are reaching the pfSense host.

                            1 Reply Last reply Reply Quote 0
                            • S
                              swordsaintx
                              last edited by

                              im sorry but how do i do that?

                              1 Reply Last reply Reply Quote 0
                              • S
                                swordsaintx
                                last edited by

                                i did it but it doesn't show anything

                                1 Reply Last reply Reply Quote 0
                                • Cry HavokC
                                  Cry Havok
                                  last edited by

                                  Then it suggests the packets aren't reaching your pfSense host.

                                  One question, in your diagram you show your IP allocation as being 67.40.148.248/29.  With that in mind, what's the default gateway?  I see you're using .249 (typo in the diagram as 149), 250 and 251.  .248 is the network address and .255 is the broadcast.  That leaves .252 to .254, but you're using .254 for pfSense, so is it .252 or .253?

                                  Also, have you configured VIPs for the other IP addresses?

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    swordsaintx
                                    last edited by

                                    67.40.148.248 is reserved .254 is for pfsense 255 is broadcast so .249 to .253 are usable. my isps default gateway is 63.231.10.241 which is set by pppoe. I have vips for the five usable ips

                                    1 Reply Last reply Reply Quote 0
                                    • Cry HavokC
                                      Cry Havok
                                      last edited by

                                      I assume your DNS servers can reach the Internet, as can the other hosts on the network?  Having an off-network default gateway is odd, but I'm assuming that's normal for PPPoE (which I've never used).

                                      If so, time to contact your ISP - if the packets aren't reaching the pfSense host then it means they are either blocking the traffic or there's a routing issue.

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        swordsaintx
                                        last edited by

                                        my dns servers can reach the internet and all other host on my network. I  called my isp and they said that no ports where being blocked. but i noticed that i can reach my ispconfig server by useing the external ip http://67.40.148.249:8080 but when i us the domain name http://web1.dial4tech.com:8080 it wont work. when i do did on my dns servers it says  connection timed out; no servers could be reached

                                        1 Reply Last reply Reply Quote 0
                                        • Cry HavokC
                                          Cry Havok
                                          last edited by

                                          Yes - if your DNS servers can't be reached then you can't use DNS names in your domain to reach any services on your domain…  That really shouldn't be a surprise - and frankly if it is I'm not sure you should be running your own DNS servers (yes, I know that's a little harsh - but it's also true).  Also note that I can't reach that URL you refer to - it's timing out for me - I'm assuming you remembered to do these tests from outside your own network.

                                          At this point everything you've posted suggests either that you've got another device upstream that does filtering (DSL modem?) or your ISP is port blocking and their staff don't know that.

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            swordsaintx
                                            last edited by

                                            i understand how dns works i was just telling you that so you could understand better my situation. being able to reach my server with external ips means that they are working but my dns is being blocked some how. my isp says they aren't blocking anything. so i was thinking it may be my dns registrar.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.