Port forwarding is not working
-
G'day
I've been trying to forward a port for uTorrent so as not to use uPnP. With uPnP on everything works well (so not an ISP issue).
During my tests I turn off my client firewall to eliminate that. Following the forum guide The NAT Port Forward looks like:
If Prot Src.address Src.port Dest.address Dest.port NAT IP NAT Port Description
WAN TCP/UDP * * WAN Address 63443 192.168.1.3 63443 -The associated rule is automatically created. uTorrent is set to listen to port 63443 & the client IP address is static.
From what I can tell and from other screen shots I've seen it should be good to go but it doesn't. Any suggestions?
Thank you very much.
R
edit Changed Protocol to TCP/UDP
-
I could be wrong but doesn't uTorrent use µTP as it's transport and not TCP. You can test by port forwarding and allowing TCP/UDP
-
Thank you for your reply. I did try that earlier without success. I have, however, modified the current forwarding/rule to TCP/UDP to move forward.
After changing the rule I checked on the states and now see several lines (with different ports) that look like:
Proto Source -> Router -> Destination State
udp 224.0.0.252:5355 <- 192.168.1.3:49711 NO_TRAFFIC:SINGLE -
224.0.0.252 is a multicast IP.. And 5355 is used in LLMNR (Link Local Multicast Name Resolution)
I doubt that has anything to do with your actual torrent traffic ;)
-
Haha…ok. Well as it says under my name - NEWBIE (in every sense of the word). :-[
-
Well assuming port 63443 is the correct port on your uTorrent client there should be something in the logs. Failing that run a packet capture and get someone to attempt to connect to your PC with their client and see if the info agrees with what you have setup.
-
I've confirmed that the NAT/Rule and uTorrent/bitTorrent (only one client is run at any one time for testing purposes) are using port 63443.
I'm using a linux distro to test the connection and don't really see anything in the pfsense logs. Under the Firewall tab I'm seeing addresses blocked and most likely a good thing as they seem to be hammering away at us.
Feb 26 15:03:49 pf: 84.211.79.150.61092 > 192.168.xx.xxx.20955: UDP, length 52
{The 192.168.xx.xxx address is our ISP DHCP assigned address}Feb 26 15:03:49 pf: 00:00:23.936201 rule 1/0(match): block in on fxp0: (tos 0x0, ttl 108, id 16815, offset 0, flags [none], proto UDP (17), length 80)
I don't see anywhere in any of the log tabs my pc ip address of 192.168.1.3 (static address - not dhcp assigned)
I've not done a packet capture before so I'll try to research that but first can you tell if there is there a package for pfsense or will I have to d/l one?
Thank you,
Randy -
192.168.xxx.xxx is an address block covered by RFC 1918. If this address is being assigned by your ISP's DHCP it would indicate that they are doing carrier grade NAT.
If this is the case you are basically %$8&!^ as there is no way someone outside their network can get to you.
-
^ exactly!! Unless your controlling the NAT device in front of your pfsense. Then you could forward the ports you want on that device to your pfsense wan IP, and then have pfsense forward that to IP inside your network.
So is your pfsense wan start with 192.168? As mentioned already that is PRIVATE address and not routable on the private network, there is no reason to hide it, just like you didn't hide that your forwarding to 192.168.1.3
What is your pfsense wan IP – lets hope its not also on a 192.168.1. address.
As to doing packet capture on pfsense - its already there, nothing to download its under the diagnostic tab. You would would something to read it with, say wireshark or something. pfsense will report some basic info you do in the capture - but if you want to look at the details you will need to download the capture and open in say wireshark on your PC.
So your saying this worked with UPnP?? Was that before you pfsense was put in? And you were doing UPnP to your ISP provided router??
-
OK…my ISP assigned IP is 192.168.25.179
Yes....if I enable uPnP everything works like a charm for the bit torrent clients.
Also, the World Of Warcraft client P2P also works no problem (even without uPnP) if that helps shed some light.
As always...thank you for your efforts.
Randy
-
You do understand that torrents do work even without inbound ports.. Sorry but even if pfsense uses UPnP to open up the port, that is NOT going to open it up on the NAT in front of you. Now not going to be as fast if you had ports open, because your only seeds. If peers can not ask you for parts of the torrent, and you send them stuff back - then they will shut you down and not share stuff with you. So depending on the seeds/peers of any specific torrent your speeds might be ok, or they might really really blow. But you do not require inbound ports to download stuff.
It is NOT possible to route traffic to 192.168.25.179 over the public internet - its just NOT!!
So you have access to the ISP device your plugging pfsense into? If so then you could put your pfsense wan IP into the DMZ of that device.
To explain this further - go to say http://www.whatsmyip.org/
You get something like Your IP Address is 24.13.xx.xx (mine) at the very top. This is the public IP you use on the internet. Most likely this is the IP either at the wan side of the device your plugging pfsense into or worse case somewhere in side your isp network. BTW do you have a model number of this device, most likely its just a typical home gateway device doing NAT, just like any soho router anyone would use in their home.
So in your setup you get something like this
internet – 24.13.a.b (isp device) 192.168.25.1 -- 192.168.25.179 (pfsense) 192.168.1.1 --- 192.168.1.3 PC running torrent
So you can tell pfsense all day long to forward any traffic it sees on its wan 192.168.25.179 on port 63443 to your PC IP, problem is the isp device at 24.13 gets this unsolicited traffic on 63443 and says nope not in answer to anything clients behind me request = drop!! So pfsense never sees the traffic to forward.
So what you need is access to the isp box and tell it hey ANY unsolicited traffic you see for ANY port!! You send it on to that 192.168.25.179 address. Now pfsense will see it and use its firewall/Nat rules to determine if should drop this traffic or forward it on.
Now if what is happening is NAT is somewhere upstream in the carrier, or you don't have access to that isp device web gui or cli to make adjustments. Then there is just nothing your going to be able to do to get inbound unsolicited traffic like that to work.
-
I do realize that I can still d/l without a port being open but I can't share and end up being penalized. What I still don't understand is if uPnP is enabled I immediately get clients connecting to my machine and uploading.
The ISP provides service by wireless so I don't have a ISP provide router per se. What I do have is a very small power over ethernet box between the pfsense box and the wireless radio on the roof. I don't have access to the webgui address for the radio.
The installer told me that they don't have an issue with torrenting unless you abuse the bandwidth under the Fair Service agreement. So what I'll do at this point is contact tech support and armed with the info you've provided and see what they have to say.
Thank you,
Randy -
Your saying that if you use UPnP with pfsense that it works - or do you mean if you use UPnP when just connected to your ISP device then it works?
-
If I enable uPnP on the pfsense router and enable it within uTorrent then uTorrent passes its internal tests for d/l & u/l and gives a green check mark showing the port is open. Once that's done I see other people connect to my client and I see them uploading.
At this point I have not done anything on the ISP side of the pfsense router.
R
-
Well things seemed to work but after a bit it all seems to die…so just as you said - it's not going to work. I called the ISP and their modem was currently set in 'router' mode. They are going to switch it to 'bridge' mode and I will have to manually enter the WAN IP address to the pfsense router - not a big deal.
I'll update the thread with the, hopefully, successful results. ;D
R
edit Hmmm...hopefully I do that right! Under the WAN interface I'm guessing I set the "Type" to "Static"
-
yeah if they are going to give you a IP to set, then it would be static on the wan interface, you will need the netmask and the gateway address to use as well.
Once you on public on pfsense wan, you should be golden! Please do let us know.
-
The ISP set their radio to bridge mode and gave me the static IP, gateway IP and subnet mask of 255.255.255.0. For the life of me I could not find where to change the subnet and under the Interface Status page the WAN subnet showed 255.255.255.255.
While the tech was on the phone I apologized and asked them to set the radio back to 'router' mode so that I could access the forums and ask how/if it was possible to change the WAN subnet. Unfortunaetly I now could not access the Internet despite being assigned a DHCP address (192.168.25.179)! I called them back and they said they would come out next Teusday…sigh.
Well that wasn't going to cut it for me... but so as not to ramble on too much about my attempts to get things going ;D I ended up plugging in the router that I had setup as a Wireless AP and in trying to reset the wan/lan info it would reset to 10.0.0.0 and the login page was for AirOS (their WebGUI login). Back on the phone to tech....here's a clue for you (ISP) guys and that's when they realized they f&^(&d up the reset. ::) Now that I have internet access again I can start rebuilding my network.
Question is...is it possible to change the WAN subnet from 255.255.255.255 to what they want 255.255.255.0 or is this some oddball setup on their part? If changing it is possible where do I find it?
Thanks so much for all the help…I'm hoping we are seeing the light at the end of the tunnel.
Randy
edit I don't like being a noob :-[ but after plugging in the pfsense router my dhcp assigned address is now 10.0.0.113 and not the 192.168.25.179. I have no ideas of the implication of this but I have internet so I'm not going to touch it just yet..especially now that there will be no tech support for the weekend. If this is BAD please let me know. :-X
-
And that is still a PRIVATE address 10.0.0.113
10.x.x.x, 192.168.x.x and 172.16-31 are all private and put you in same boat.
Did you notice the dropdown where it says /32 – just change that to /24 if they are giving you a 255.255.255.0 mask.
-
Awesome…thank you, I would never have stumbled onto that. I'll give them a call during the week when there is tech support available to change the radio back to bridge mode and I'll let you know how it pans out.
R
-
Well a tech called me on a Sunday! Static IP is setup and port forwarding is working like a charm now. Thank you very much!!
One thing I noticed after the change up the RTT under Gateways went from .25(ish) ms for the dhcp address to 1.5(ish) ms under the static IP. Probably not a big deal…just curious (as always).
So how do I go about buying you a beer? ;D
R
