Port 22 doesn't forward
-
Hi,
pfSense 2.2.1-RELEASE (amd64).
I have two WANs + LAN.
WebConfigurator on port 9999
ssh on port 222.I want to forward port 22 from WAN to ip address from LAN, but this doesn't work.
See attachment for NAT port forward rules.
Firewall rules for all interfaces are to pass all traffic.But if I forward any other port, like 2244 then all is fine.
Why i cant forward port 22?
Sockstat output:
[2.2.1-RELEASE][root@border]/root: sockstat USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root sleep 51736 15 stream /var/run/php-fpm.socket root sshd 34430 5 tcp4 x.x.134.165:2222 x.x.197.249:50163 root php-fpm 25583 0 stream /var/run/php-fpm.socket root php-fpm 25583 10 dgram (not connected) root php-fpm 25583 11 udp4 *:* *:* root php-fpm 25583 12 udp6 *:* *:* root sh 17906 15 stream /var/run/php-fpm.socket dhcpd dhcpd 15953 9 dgram -> /var/dhcpd/var/run/log dhcpd dhcpd 15953 13 udp4 *:67 *:* dhcpd dhcpd 15953 15 stream /var/run/php-fpm.socket dhcpd dhcpd 15953 20 udp4 *:15216 *:* dhcpd dhcpd 15953 21 udp6 *:49484 *:* unbound unbound 12228 10 udp4 *:53 *:* unbound unbound 12228 11 tcp4 *:53 *:* unbound unbound 12228 12 udp6 *:53 *:* unbound unbound 12228 13 tcp6 *:53 *:* unbound unbound 12228 14 tcp4 127.0.0.1:953 *:* unbound unbound 12228 15 stream /var/run/php-fpm.socket unbound unbound 12228 16 dgram -> /var/run/logpriv unbound unbound 12228 17 stream -> ?? unbound unbound 12228 18 stream -> ?? unbound unbound 12228 19 stream -> ?? unbound unbound 12228 20 stream -> ?? root lighttpd 38361 11 tcp4 *:9999 *:* root lighttpd 38361 12 tcp6 *:9999 *:* root lighttpd 38361 13 tcp4 *:80 *:* root lighttpd 38361 14 tcp6 *:80 *:* root lighttpd 38361 15 stream /var/run/php-fpm.socket root lighttpd 38361 17 dgram -> /var/run/logpriv root sshd 36821 4 tcp6 *:2222 *:* root sshd 36821 5 tcp4 *:2222 *:* root ntpd 60877 3 dgram -> /var/run/logpriv root ntpd 60877 20 udp6 *:123 *:* root ntpd 60877 21 udp4 *:123 *:* root ntpd 60877 22 udp6 fe80:1::b0b3:97ff:feee:6e5c:123 *:* root ntpd 60877 23 udp4 x.x.185.139:123 *:* root ntpd 60877 24 udp6 fe80:2::4c5a:f4ff:fe35:29b6:123 *:* root ntpd 60877 25 udp4 x.x.134.165:123 *:* root ntpd 60877 26 udp6 fe80:3::4aa:7aff:fe26:4fae:123 *:* root ntpd 60877 27 udp4 172.16.0.1:123 *:* root ntpd 60877 28 udp4 127.0.0.1:123 *:* root ntpd 60877 29 udp6 ::1:123 *:* root ntpd 60877 30 udp6 fe80:6::1:123 *:* root sshlockout 56534 3 dgram -> /var/run/logpriv root login 56273 3 dgram -> /var/run/logpriv root cron 48301 5 dgram -> /var/run/logpriv root syslogd 48239 10 dgram /var/run/log root syslogd 48239 11 dgram /var/run/logpriv root syslogd 48239 12 dgram /var/dhcpd/var/run/log root syslogd 48239 13 udp6 *:514 *:* root syslogd 48239 14 udp4 *:514 *:* root apinger 12292 1 dgram -> /var/run/logpriv root sshlockout 11757 3 dgram (not connected) root inetd 9257 11 udp4 127.0.0.1:6969 *:* root filterlog 8875 9 dgram -> /var/run/logpriv root devd 269 10 stream /var/run/devd.pipe root check_relo 257 3 stream /var/run/check_reload_status root check_relo 257 6 dgram -> /var/run/logpriv root php-fpm 241 10 dgram (not connected) root php-fpm 241 11 udp4 *:* *:* root php-fpm 241 12 udp6 *:* *:* root php-fpm 241 15 stream -> ?? root php-fpm 241 17 stream -> ?? root php-fpm 241 18 stream /var/run/php-fpm.socket ? ? ? ? tcp4 x.x.134.165:9999 x.x.197.249:50102Looks like there are no one locks 22 port. But why this doesn't work?
-
maybe its blocked by isp, maybe firewall on 172.16.1.3 blocks it?
Why don't you just sniff on the wan and validate that your seeing the traffic.. Why do you have udp forward, since when was ssh udp??
If you see on wan, then on lan sniff is it being sent to 172.16.1.3??
Have you looked over and followed?
https://doc.pfsense.org/index.php/Port_Forward_TroubleshootingSo you have dual wan, how do you have return setup.. What determines that traffic from wan1 goes back out wan1? Normally you wouldn't forward from both wans to same host, etc. I would validate with wan1 first, make sure that works and if wan 1 is your default outbound? Then once you have one working you can work on second wan inbound forward.
-
maybe its blocked by isp, maybe firewall on 172.16.1.3 blocks it?
No, a have tried this by setting SSH access for pfSense by port 22.
Why don't you just sniff on the wan and validate that your seeing the traffic.. Why do you have udp forward, since when was ssh udp??
I tried it by tcpdump, but there are no packets on wan to 22 port… :(
But a can access to other servers by this port. Hmm...
Will search in this direction, thanks.About udp, thanks, it's my mistake.
-
"No, a have tried this by setting SSH access for pfSense by port 22."
Huh? So you access the server from pfsense via ssh, that would be from same segment.
If you are checking tcpdump and no traffic to 22, how could it ever forward to machine behind it..
-
Sorry, it was my mistake, i had access from another network :(
Now I wrote to my ISP to check blocked ports.
-
sure your actually hitting your public ip from outside? Possible if your using a fqdn vs IP that you have the wrong one.. If your behind a NAT did you forward it there. Do you have public IP or rfc1918 address on pfsense wan?
-
The problem in ISP, thank you for suggestion.
