2.2.2 Breaks NAT – firmware bug?

breakaway

Hi,

I look after 50+ pfSense instances. Over this weekend, I went to upgrade a few of them to 2.2.2 (some were on 2.2.1, some on 2.1.5 etc)

I've got an issue with v 2.2.2 of pfSense breaking NAT. Specifically port forwards no longer work.

It looks like port forwards that were already in-place before the upgrade work, but no new ones work at all despite the gui not showing any errors.

After I added the port forward rule, when I go into Diagnostics > System Logs > Firweall, I can see lots of blocked traffic entries there and when I click on the "X", it tells me it was blocked by the "Default Deny All" rule.

I have verified this was indeed the fault by downgrading my router (thank god for vmware snapshots) to firmware 2.2.1 or earlier.

Can someone please shed some light on what I can do to diagnose this? I did see this thread wherein a similar issue was caused due to traffic shaper but I am not using the traffic shaper.

killmasta93

Why dont you start from scratch? Try installing 2.2.2 on another virtual machine to test your theory. If it worked then the problem was the upgrade. If it didn't then try to disable traffic shaper.

breakaway

Thanks for your response, but if you read my post carefully you'll see that I said that I don't use traffic shaping.

I'll can try installing 2.2.2 fresh but ultimately that is not an option - even if it does work, I can't really go around reinstalling 50+ pfsense manually, rebuilding the config etc.

There's at least 2 other threads with people having these types of issues, so I'm more interested in finding out what's actually going wrong rather than wipe it out and start again.

johnpoz

And what version of vmware are you hosting these on? I have not had any issues with port forwards after upgrading to 2.2.2 from 2.1.5 to 2.2 to 2.2.1, etc..

What tools vmware tools are you running? 2.2 is broken with native tools for example.

I have to assume your 5.5u2 at min, and what tools? Your sure its the default rule? what forwards are not working? Why don't you enable listing the exact rule in the log, etc.