Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port not open? Only filtered?

    Scheduled Pinned Locked Moved
    NAT
    2
    20
    9.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mogie
      last edited by

      I now see that the "rules" page only show TCP on all rules, though some of them uses UDP og both TCP/UDP.

      I've changed this setting on the rules page, on hope of better results, but no…

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        @mogie:

        "php: : New alert found: # unresolvable dest aliases NAT ftp active" it says in the log."
        How do I diagnose this message? At least to the FTP the the problem must be here!

        This looks like your problem. Can you pm me your entire config.xml copied from status.php?

        1 Reply Last reply Reply Quote 0
        • M
          mogie
          last edited by

          @cmb:

          @mogie:

          "php: : New alert found: # unresolvable dest aliases NAT ftp active" it says in the log."
          How do I diagnose this message? At least to the FTP the the problem must be here!

          This looks like your problem. Can you pm me your entire config.xml copied from status.php?

          I've send a PM with the .xml-file. I hope it was the whole XML-file you ment :) check your inbox

          (I've replaced loginnames and passwd with mYpassword etc)

          1 Reply Last reply Reply Quote 0
          • M
            mogie
            last edited by

            Do you find anything? :)

            1 Reply Last reply Reply Quote 0
            • M
              mogie
              last edited by

              If anyone else want to help I got the XML-file here:

              http://teamgule.net/config-pfsense.lan-20071029163349.xml

              Thanks again for those helping! It is really appreciated!

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                just saw your pm today. I won't have time to look at it tonight, but maybe tomorrow, if not definitely this weekend.

                1 Reply Last reply Reply Quote 0
                • M
                  mogie
                  last edited by

                  is the PM really working? I haven't got any outbox mails after sending some…

                  1 Reply Last reply Reply Quote 0
                  • M
                    mogie
                    last edited by

                    Update: I've updated the link above if anyone want to look at it again:  :)

                    http://teamgule.net/config-pfsense.lan-20071029163349.xml

                    1 Reply Last reply Reply Quote 0
                    • M
                      mogie
                      last edited by

                      I'm getting a new ISP this weekend I hope.. with static IP (eventually!!). They do not use PPPoE, maybe it may solve some problems :)

                      1 Reply Last reply Reply Quote 0
                      • M
                        mogie
                        last edited by

                        I've tried a new network layout now:

                        Modem w/firewall & NAT          pfsense w/ or without NAT
                        LAN 192.168.1.1          –--------> 10.0.0.138  -----------> LAN
                        WAN 85.167.x.x

                        I have NATed all ports on the routermodem to the pfsense-box. Things is all the same. All NATs is working but not port FTP, Counter Striker, Passive FTP(2300-2400). It makes no difference in which services I'm running additionaly (DHCP, Traffic shaper etc) - in fact there's no logic in this not working in any way at all. Also tried to reset the pfsense box may times, restored the settings in different combinations, though the result is the same.
                        All of this SHOULD work, and I'm serious considering trying monowall instead, cause it has the same features that I'm looking for.

                        For the new ISP part, I'm still waiting - But like I said - the problem lies in the pfsense box software, not the connection to my ISP or WAN connection.

                        It makes no difference trying to disable the NAT on the pfsense router. Neither does a lot of other features like I've told.

                        Should I go back and try the pfSense 1.0 stable maybe? Thanks for all advices!

                        1 Reply Last reply Reply Quote 0
                        • M
                          mogie
                          last edited by

                          ok.. I've actually managed to get some connection on the FTP-port in active mode: but ONLY through a FTP-client program (LeechFTP). Not in passive mode of course..

                          WAN  - Disable the userland FTP-Proxy application  is [CHECKED]
                          LAN - Disable the userland FTP-Proxy application  [NOT CHECKED]

                          As I mentioned; I have the firewall and the first forward at the routermodem (192.168.1.1) . And therefor all connection rules on the pfsense-box is allowed (both to WAN and LAN).
                          I have NAT'ed these ports:

                          If  Proto  Ext. port range  NAT IP  Int. port range  Description

                          WAN  TCP    21 (FTP)             10.0.0.4(ext.: any) 21 (FTP)  
                          WAN  TCP    80 (HTTP)             10.0.0.4(ext.: any) 80 (HTTP)

                          Why is it not possible to browse through the FTP-server with a webbrowser like I used before (without the pfsensebox between), but only though the client?

                          I've compared carefully two outputs with LeechFTP - both servers running Pure-FTPD, one connection to my server, and one an outside server. I get the exact same outputs. So I need to know how the browsers get the FTP-connection.  Is it allways thorugh passive connection?

                          1 Reply Last reply Reply Quote 0
                          • M
                            mogie
                            last edited by

                            I now got the Passive FTP to work at first try though the LeechFTP… dammit!

                            Still, using browser is hopeless. If anyone can see anything useful here, please let me know:

                            proxy    331  0.0  0.2   704   452  ??  Ss    9:02PM   0:00.16 /usr/local/sbin/pftpx -c 8021 -g 8021 10.0.0.138
                            1 Reply Last reply Reply Quote 0
                            • M
                              mogie
                              last edited by

                              My prevoius reply about FTP only working through LeechFTP was wrong. It was because I testet it with NAT reflection to my IP-adresse, and thats why it worked in that case only. I've testet it from an other public IP, fininding the same result all over:

                              Through SSH from an outside IP-adresse i get:

                              500 This security scheme is not implemented

                              And with an online FTP-client i get the 500 error too:
                              http://www.g6ftpserver.com/en/ftptest

                              * About to connect() to mydomain.net port 21
* Trying 85.167.x.x... connected
* Connected to mydomain.net (85.167.x.x) port 21
< 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 
< 220-You are user number 2 of 10 allowed. 
< 220-Local time is now 02:09\. Server port: 21\. 
< 220 You will be disconnected after 15 minutes of inactivity. 

> USER anonymous 
< 230 Anonymous user logged in 

> PWD 
< 257 "/" is your current location 
* Entry path is '/'

> CLNT Testing from http://www.g6ftpserver.com/ftptest from IP 85.167.x.x 
< 500 Unknown command 
* QUOT command failed with 500
* Connection #0 to host mydomain.net left intact

* Closing connection #0
                              1 Reply Last reply Reply Quote 0
                              • C
                                cmb
                                last edited by

                                Finally getting a chance to look at this closer. What is the problem at this point? Sounds like things have changed since earlier?

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mogie
                                  last edited by

                                  I've been testing m0n0wall instead, with some luck, and some lack of features compared to pfsense.
                                  The NAT reflection feature is not supported in m0n0wall, so I'll need to foreward manually thorugh DNS forwarding. Anyways, I'll be able to fix this if I can get to ports to finally work some time in my existing life ..

                                  Using m0n0wall:
                                  Compared to pfsense, finally, the CStrike Server is visible from the outside with m0n0wall.
                                  Though the FTP-problems are still the same as on the pfSense-box.
                                  I'm able to connect the server in some way and almost get a response (see previous post)

                                  In short.. I've tried every single combination of settings that I could ever think of in order to get the NAT working properly. Believe me! I've tried booth setting up double NAT, and bridge the modem to the pfsense/m0n0wall-box and then connect using PPPoE. The only thing I see now, is that there's something terrible wrong with the software I must be using… or that there's some mysterious blocking at the modem when it is in brigdemodus.. (not logical at all!)

                                  Anyways. The problem still lies in the XML-file that I've deployed for pfSense. (if it does have a problem at all) Look at my previous post to download it.

                                  I've been testing from remote FTP-clients to my network for this.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mogie
                                    last edited by

                                    UPDATE:

                                    I've managed a double NAT in active ftp in some way..
                                    I've set the "ForcePassiveIP" parameter in pure-ftpd to the external address outside the network the server is on (192.168.1.1) in order to get passive on m0n0wall working. I've now tried to set up the pfsense too, and it seems to have payed off! :) Passive FTP is working trough the pfSense box now, I'm going to troubleshoot the passive connection in the meantime..

                                    I've testet trough SSH on an external server

                                    server <–----------->  pfsense/m0n0wall <-------------------------> routermodem (PPPoE)
                                    10.0.0.4                    10.0.0.138/192.168.1.1                                85.167.x.x

                                    Like I said, this is with double NAT. I have no idea why the bridge on the modem, and the PPPoE on the pfSense didnt work. Neither how the ForcePassiveIP parameter affected the active FTP-connection with the server..

                                    Though, it do not work through the simple external FTP-tester I've been using a lot, including the SSH ofcourse.
                                    http://www.g6ftpserver.com/en/ftptest

                                    To others experiencing the same issue:
                                    Configure passive connection on your FTP-server and force the passive IP to the external IP from the network your in. (above)

                                    Though again. This configuration may be trouble for my CStrike connection. I will need to test out that too..

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post