Forward CCTV port doesn't work, I don't know why because I configure NAT policy same remote, ssh, imap etc it work but CCTV not work,
please see my picture.
for local it working.
From what I am thinking you are wanting to connect to the cctv webpage from outside your internal network?
If so you would need to connect through your browser something like: http://wan address:99
Inside you local network (assuming on the same subnet etc) http://192.168.1.121:99 would work are you are on the inside so the port is not being blocked.
Port 99 is not a normal "web" port like 80, 8080, 443 so it could be possible that if you are trying to connect from outside your wan port 99 is being blocked?
First guess - your CCTV box doesn't have a default gateway defined, it must have one for that to work.
Thank you for your suggest, I already check CCTV box have default gateway, and I try to change port to other port but doesn't work,
If I want to allow any to any port for this IP I can do or can't? (for test)
Have you tried looking at a network trace before? If you capture a network trace on the WAN while you're trying to connect, you should be able to see if traffic is getting to pfSense (which we expect) and if pfSense is responding to that traffic. You can do the same on the LAN to see if pfSense is then sending traffic on to your CCTV. If you need help reading the output, I'd be glad to help.