Opening the firewall port [new]



  • Hi

    I am in a LAN and I have a computer where I have a utorrent client that uses the 31950 port.

    Now to open this port, I have done:

    but the client still indicates that the port is closed.

    Where I'm wrong?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    Well from looking at the first picture your WAN is a private - so its behind a NAT..  Did you forward the port you want to use at the Nat device in front of pfsense?  Did you put pfsense in the dmz of that first nat device?

    Why do you even have a NAT in front of pfsense?  Pfsense is designed to be the role of your NAT Router/Firewall at your gateway.



  • In practice, my LAN formed by an ADSL modem (10.0.0.1) with PPPoA, a NAT router/firewall (192.168.1.1) with pfSense and 6 computers.

    So, how do I open in both directions the 31950 port on the Pluto computer (192.168.1.3)?

    Thanks

    Bye



  • Clicking the x icon of this image, this window is displayed:

    I can not find the "default deny rule" rule. How come? How do I change it?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    if the traffic reaching your pfsense wan already - then just create a port forward to whatever 192.168 address you want to send the traffic to.

    You don't change the default deny rule - you put allows before it.  Once you create a port forward it will automatically create the wan rule to allow the traffic

    as to outbound by default all ports are open.



  • @johnpoz:

    if the traffic reaching your pfsense wan already - then just create a port forward to whatever 192.168 address you want to send the traffic to.

    You don't change the default deny rule - you put allows before it.  Once you create a port forward it will automatically create the wan rule to allow the traffic

    as to outbound by default all ports are open.

    How do I create this rule?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    under port forward!

    Firewall, NAT



  • @johnpoz:

    under port forward!

    Firewall, NAT

    You try to look at my first post of this thread and you could tell me where I'm wrong.

    By chance, I have to add some other rule? If so, which one?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    you don't show your firewall rules in those posts.  And for another they are SO SMALL I can not read them..  Just attach them directly vs imgur or use something better than 500x500 freaking thumbnails.

    What you show it like your going to create the rules - but not the actual rules being created.  And again they are so small I can not make out the details.  It was hard enough making out that you had a private on your wan.



  • Now, I hope that my images are big:

    Where I'm wrong?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    show the rules in the firewall tab as well.  Do you have source setup?  You don't have the forward and the wan rule linked?  Why not?  When you create a port forward the system can auto create the wan rule for you.  Seems you did not do that.

    For all I know you have source ports setup - can not see them in your image.



  • I created only these two rules. In fact:

    The other tabs contain only the default rules.

    So, what does not work?

    The Source parameter set to "any" is right?

    On the NAT, what is the difference between Destination and Redirect target IP?

    Thanks

    Bye



  • Could you help me again?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    Your behind a NAT - so your destination is to a private IP that 10.x.x.x on your WAN interface - did you disable block private IPs on the wan interface?  See attached pic

    I don't see it in your wan rules - so I would have to assume you did.  Did you have any other rules on say the floating tab?

    Also I would try it without the aliases.  Just put in the IP and ports vs using aliases.  Does that fix the problem and allow the traffic?

    edit:  After checking your aliases again - that does not look like a 192 to me.  Do you have a typo in your alias??  hard to say with such a small screenshot that I had to zoom in on trying to make it out.






  • Thank you for found the incorrect address in the Pluto but, unfortunately, the 31950 port is always closed.

    So now, my configuration is this:

    Where I'm wrong?

    What is the purpose of the rules of the floating table?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    Gawd it is such a pain in the trying to view your images – have to click into them that opens a new window then zoom in because are thumbnails of what your posting..

    If the IP address your trying to forward too is wrong - its not going to work..

    I don't see any rules in your floating tab.   Did you change your rules to use just IP and port vs aliases??  Why is there anything listed in you NAT rules if your doing automatic NAT.  You must of switch to manual at some point?

    Delete your current rule and forward - create a NEW forward and let it auto create your wan rule.  See below, see how used the actual IP and the actual port number vs alias.

    See how when I look at the firewall wan rule shows it associated to port forward.  Also delete all the stuff in your NAT section if your going to leave it on auto.  And could you please just attach your images?  It makes it SO MUCH Easier to view vs some outside place.








  • I tried to follow your instructions and delete all the rules that were in the Outbound table but the 31950 port remains closed. How come?

    I have to create some rule in the table Floating? If so, which one?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    ARGH!  Dude did you create a NEW NAT and let it create the rule using IP and Port vs your alias??

    That is just clean up work - since from your post you had Auto Checked - so there shouldn't be any rules listed there unless your doing Manual NAT.

    NO you don't have to create anything in the floating TAB!



  • @johnpoz:

    ARGH!  Dude did you create a NEW NAT and let it create the rule using IP and Port vs your alias??

    That is just clean up work - since from your post you had Auto Checked - so there shouldn't be any rules listed there unless your doing Manual NAT.

    NO you don't have to create anything in the floating TAB!

    I understand that, setting to "Automatic outbound NAT rule generation", I should not create any rule in the table Port Forward but I should only have these settings:

    Right?

    Unfortunately, the 31950 port is still closed.

    Now, where is the error?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    DONT USE THE FREAKING ALIAS!!  How many times do I have to say it???

    Put in the ACTUAL PORT and IP

    And you don't even show your NAT rule – for all I know you don't have it!  Do you still show firewall blocking the port??  Then your nat and rule are NOT being applied.

    And if you post one more picture to imageshack -- I am done trying to help you!!  It take me 2 freaking clicks and another window trying to make out something that is not even worth looking at.


  • Rebel Alliance

    balubeto

    Not directly related with the Topic, but, instead of upload the screenshots ti external hosting why don't you upload them directly to the forum ?

    when you "reply" you have the "aditional Options" and there you have the option to attach files (images) to your post, please use it instead imageshack.



  • LAYER 8 Global Moderator

    ^ exactly!!!  Look how easy it is too view that image..  Make it very easy to see what he is talking about and help him, vs have look at another tab, then wait for the stupid flash interface to finish so you can hopefully zoom in 1 click and see something.  Just to find out its the same shit you have been posting all along.

    The alias tab, and the firewall edit screen not showing anything worth looking at.  Your firewall wan rule clearly is not LINKED to your NAT rule like I have said pretty much every single post to do.  Use the IP and PORTS, and let the NAT rule create your wan rule!  Its that simple.  A port forward should take you like 15 seconds to create.

    Also your on windows 7 use the snipping tool so you don't have to post the WHOLE screen when you want to show 1 small part of it.




  • I'm sorry but I can not understand anything more because some people say to use only the alias and others say to use direct the IP addresses and ports.

    I have an idea: Could someone explain to me how to restore the default values ​​of the 6 tables of the NAT and firewall and how I will have to do to open the 31950 port in incoming and outgoing to a computer that has the IP address 192.168.1.3?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    What people say to only use alias??  Not in this thread - Delete the freaking rules and put in the ports and IP.  You can always move to alias after you have it working.  Takes two seconds to change a rule or create or delete one.

    The fact that this thread has been going on for days is completely and utterly crazy!

    You have shown your firewall log once – clearly your rule was not working or it would not have been blocked by the default rule.

    Delete all you wan rules - delete your port forwards.  Create a new port forward with allowing it to create you wan rule using IP and ports.  Then generate some traffic and see what happens - then we can move on.  But with your aliases in there - for all I know you have a space on the end?  There is a bug?  You had the wrong freaking IP in there to start with 193 vs 192..  So again remove the ALIASES and we can move forward.

    And if you post to imageshack I am DONE!!  Attach your images to the thread like a normal person ;)



  • Where I'm wrong?

    You remember that, in the Pluto computer, I disabled the firewall-software.

    Thanks

    Bye










  • …......





  • LAYER 8 Global Moderator

    Well from this – pfsense says it passed that traffic.

    If you not seeing it open, then tells me your 192.168.1.3 box is not listening on it?  Or firewall is blocking it?

    What I would do is sniff on the pfsense LAN interface, under diag -- do you see it send the traffic to 192.168.1.3

    If so - then .3 is not listening, or you got firewall on it, or something else between pfsense and .3 that is blocking it.

    So from pfsense diag, do a packet capture for your IP

    And thanks for the attachments in the thread - so much easier to READ!!!

    edit:  Question for you - you have a nat before pfsense, you sure there is no nat between pfsense and this 192.168.1.3 box?  Maybe a wireless router your using and its not configured as access point but natting?

    So between .3 and pfsense there is only a normal dumb switch, not acls or anything?








  • Between the Pluto computer and pfSense there is a HP ProCurve 1410-16G switch http://h17007.www1.hp.com/us/en/products/switches/HP_1410_Switch_Series/index.aspx#tab2.

    Since in this computer I have an active VNC server on the 5900 port, I tried to capture packets from this port but no packets are captured. How come?

    Thanks

    Bye









  • LAYER 8 Global Moderator

    don't capture the traffic at the server - capture the traffic on pfsense.  You need to verify that its actually putting the packets on the lan network.

    What does trying to capture 5900 have to do with your 31950 port?  And where are you accessing this 192.168.1.3 server from via vnc?  If from the 192.168.1 network no pfsense would never see this traffic.



  • @johnpoz:

    don't capture the traffic at the server - capture the traffic on pfsense.  You need to verify that its actually putting the packets on the lan network.

    What does trying to capture 5900 have to do with your 31950 port?  And where are you accessing this 192.168.1.3 server from via vnc?  If from the 192.168.1 network no pfsense would never see this traffic.

    I also tried to capture packets on the port 31950 but with the same result.

    Since all the computers are on the same network 192.168.1, how do I fix this?

    Thanks

    Bye


  • LAYER 8 Global Moderator

    So if your not seeing packets on the pfsense lan (capture on pfsense) interface for 31950 once you generate traffic and see a pass in the firewall logs.  Then yeah something is not right - something misconfigured.

    But I find it hard to believe - I have never had issue one with pfsense and a port forward. Click and its done and works.  Its as simple as filling out the port forward page, and letting it configure the wan rule.

    So unless your traffic is coming into a different wan interface??  If your not seeing the packets on the lan interface then you have something wrong in your rules plain and simple.

    So I would suggest you start a capture on the correct port and 192.168.1.3 address on the pfsense lan interface, and then generate some traffic via canyouseeme.org

    Your saying your not seeing this traffic?  Do you have more than 1 lan interface?

    edit:  Tell you what, if you want PM details on how I can remote access your pfsense and I will take a look myself.  What your trying to do should take at most 15 seconds to accomplish.


Log in to reply