Port forwarding not working (2.2.3)

divsys · Jul 22, 2015, 5:48 AM

You might try turning on logging for the redirect rule and see if pfSense even sees the attempt on Port 80.
Some ISP's block incoming port 80 traffic. You may have to redirect from some other external port # to port 80 internally.

Are you sure you're redirecting ALL the ports for your DVR?
What make/model of DVR are you using?

How is your pfSense box connected to the internet, through a modem or through another modem/router?
If the latter, you have double NAT to worry about.

johnpoz · Jul 22, 2015, 10:56 AM

It is quite possible your isp blocks inbound to 80..

Dude you hid your wan rule that allows access to pfsense, but you you have the dyndns name and port right in the first screenshot ;) Why do you have pfsense open to the public net?? Not a good idea, better to vpn in or ssh with public key auth and then tunnel to your web gui, etc..

Does whatever your forwarding too even have gateway setup? Does it have a firewall?

https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

pfguy · Jul 22, 2015, 4:47 PM

thanks for the replies.
i have tried custom port like 3456 .. same thing, doesnt work !
pfsense connect directly to internet on WAN port ..
about securities issues, i won't care much about it. The pfsense box connect to internet and provide captive portal internet access for a small cafe shop!
no file server or data whatsoever behind the Sense box so if anyone bother to hack it, i would not bother anyway as there is nothing for them!
the DVR is Questek .

divsys · Jul 22, 2015, 9:03 PM

If you turn on logging, can you see the attempts reaching the pfSense box?

pfguy · Jul 24, 2015, 8:41 AM

i had a look in Status: System logs: Firewall and did not see the IP i use to connect to the Sense box. should it be in there by default ? or do i need to turn on a setting first ? thanks

doktornotor · Jul 24, 2015, 8:54 AM

If you look at the NAT rule's "Filter rule association" on the absolutely horrible screenshots, well… that certainly does not match the WAN rule. What are you doing there with the "Pass" thing? Delete the NAT rule, delete the WAN rule. Recreate the NAT rule, leave that thing at default. Which is Add associated filter rule. There's exactly zero need to mess with the default value for like 99% of cases.

If that does not work, produce some packet captures and see whether the traffic is reaching the FW at all.

pfguy · Jul 24, 2015, 9:43 AM

@doktornotor:

If you look at the NAT rule's "Filter rule association" on the absolutely horrible screenshots, well… that certainly does not match the WAN rule. What are you doing there with the "Pass" thing? Delete the NAT rule, delete the WAN rule. Recreate the NAT rule, leave that thing at default. Which is Add associated filter rule. There's exactly zero need to mess with the default value for like 99% of cases.

If that does not work, produce some packet captures and see whether the traffic is reaching the FW at all.

thank you for clearing some stuff for me.. i redid it just like what you said, but still cannot reach the DVR from WAN. My ISP confirm not blocking any ports.

Supermule · Jul 24, 2015, 9:45 AM

Whats your public IP and do you block private networks on WAN??

doktornotor · Jul 24, 2015, 9:46 AM

As noted above - Diagnostics - Packet Capture.

pfguy · Jul 24, 2015, 10:06 AM

@Supermule:

Whats your public IP and do you block private networks on WAN??

no i dont block private networks

![private networks.png](/public/imported_attachments/1/private networks.png)
![private networks.png_thumb](/public/imported_attachments/1/private networks.png_thumb)

pfguy · Jul 24, 2015, 10:10 AM

@doktornotor:

As noted above - Diagnostics - Packet Capture.

here is the Packet Cap:

17:08:10.564104 IP 118.69.32.168.56244 > 1.54.108.71.80: tcp 0
17:08:11.561775 IP 118.69.32.168.56244 > 1.54.108.71.80: tcp 0
17:08:13.566616 IP 118.69.32.168.56244 > 1.54.108.71.80: tcp 0

pfguy · Jul 27, 2015, 4:13 PM

does anyone have any idea why this ís not working ?? :-\

chpalmer · Jul 27, 2015, 4:40 PM

Looks like your pfSense box is passing the traffic just fine.

What do you have between your box and the camera DVR?

Derelict · Jul 27, 2015, 10:04 PM

So you know the traffic is making it to WAN. Now turn on logging on the WAN firewall rule (The one NAT auto-created) and see what that shows in the firewall log.

And one more time for good measure:

https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

pfguy · Jul 28, 2015, 5:14 AM

nothing between the Sense box and PVR
I can access the DVR from LAN no problems !

johnpoz · Jul 28, 2015, 2:12 PM

"I can access the DVR from LAN no problems !"

And does your DVR know how to get off the LAN, does it have a gateway set.. Network devices can talk on their own network without any need for a gateway. But when your coming from an internet IP with a port forward, they have to know how to get off their network - ie a gateway (pfsense lan IP)

pfguy · Jul 28, 2015, 4:22 PM

@johnpoz:

"I can access the DVR from LAN no problems !"

And does your DVR know how to get off the LAN, does it have a gateway set.. Network devices can talk on their own network without any need for a gateway. But when your coming from an internet IP with a port forward, they have to know how to get off their network - ie a gateway (pfsense lan IP)

yes, i have assigned the DVR a static IP address togather with a gateway address (which is the Sense LAN IP)

johnpoz · Jul 28, 2015, 8:41 PM

well if pfsense is sending on the traffic? as you see in a lan sniff are you seeing the answer?

These issues are really 10 seconds to troubleshoot – basic 101 networking.. Is the traffic seen on wan? Does it get sent out the lan to the correct IP.. Do you see a response?

I can assure there is no issues with port forwarding in 2.2.3 nor 2.2.4 -- nor do I recall any issues with port forwarding going back to the first version of pfsense I used like 1.2.3

issues with port forwarding are not setup correctly, traffic never gets to pfsense to forward. Device doesn't answer or has firewall.

the required steps to troubleshoot are clearly laidout in the troubleshooting port forwards doc linked too.

You saw traffic on your wan, but I don't see sniff on pfsense lan showing that traffic sent or not. Please post your port forward rules and your wan firewall rules.

And tell us what IP your trying to send too, etc.

johnpoz · Jul 29, 2015, 9:48 PM

dude that is great that you sent me login and password in pm.. But what IP?

1.54.108.71

That is not listening on 80 or 443..

but is on 81 – which hits your dvr

I did a scan - and you have something in front of pfsense doing something - because that is not a pfsense box looks on a scan with nmap.. Your showing filtered on 135 for example.. Why would 53 tcp be open.

I would love to login and take a look - but you did not give me the details to do so.

johnpoz · Aug 1, 2015, 9:59 AM

Ok your fixed up - dude you had captive portal on.. Going to look if that is listed in the port forwarding troubleshooting.. How is the server suppose to talk back? So I put the mac of that 192.168.1.5 box you were forwarding to in the mac pass section, where you had your dad listed.

Now I hit your IP on 80 and get login page

Also I sent you in your PM – don't use any any on wan!! Bad Bad idea, if you want to allow access to gui.. Limit it to the port the gui is on and your wan address. And best you should of just asked me for my IP or looked in your logs for when I tried to use your vpn.

Do you want me to fix that - since its broken.. And PPTP is horrific out of date and not secure, you should just use openvpn..

edit
Just looked on the port forwarding troubleshooting guide that you went through?? Clearly not, item 9 in common problems
9. Forwarding ports to a server behind a Captive Portal. An IP bypass must be added both to and from the server's IP in order for a port forward to work behind a Captive Portal.