Cannot Port Forward
-
Hello,
I have set-up port forwarding as shown in the attached file.
192.168.0.50 is a static ip for my desktop which is running Transmission bit torrent.
In Transmission I go to Edit > Preferences where I select the Network tab.
In the network tab I set up the "Port used for incoming connections:" to 51413.
When I press the Test Port it fails with "port closed".
If I disconnect my WAN from pfsense and connect it directly to my desktop then the "Test Port" works saying the port is open so I am sure this is a pfsense problem.
I have googled, watched youtube, searched the forums and everything suggests I have set up pfsense correctly… but it does not work!
Any ideas?
-
http://www.canyouseeme.org/
"Testing" port forwards from LAN is totally useless. If that doesn't work, kindly check the firewall logs, they are there for a reason.
-
Thank you for your reply doktornotor.
I tried the web address you suggested and I get the same thing.
Then I tried the service while watching the firewall logs and nothing shows up in the logs.
-
Doesn't seem like the traffic gets to your firewall at all… is it behind some other modem/router? There's packet capture, move there.
-
I agree.
Perhaps I can explain my setup.
My cable modem goes into the wan plug while my desktop is on the lan.
pfsense works in that I surf the web with it.
If I run canyouseeme it does not work even though I believe I have configured port forwarding correctly.
BUT, if I temporarily disconnect pfsense and connect my desktop directly to the modem then canyouseeme works.
So, that is why I believe the problem must be pfsense.
-
Do you also have a firewall rule on WAN that allows incoming traffic on that port to reach your LAN? Post your WAN firewall rules.
-
Attached is a capture of the WAN firewall rules.
-
There's really not much else to it. Good list of things to check here:
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting
-
Do a packet capture on LAN just to confirm that the test packet is getting through, and any replies.
-
What is the source of the traffic your blocking rfc1918 and bogon which could be blocking it before it gets to your nat allow rule.
Does pfsense actually get a public IP on its wan? You say modem, but most of the time when users say modem they really mean gateway that is doing nat. If you have a nat in front of pfsense you need to make sure you forwarding that traffic you want pfsense to forward too pfsense in the first place.
-
The attachment is a packet capture while using canyouseeme which could not see my service on port 51413.
If I am understanding it the packet goes out and comes back in to my computer but yet canyouseeme says the port is closed?
By modem I was referring to a Motorola cable modem and I don't think it is a problem because I mentioned I can bypass pfsense and connect my computer directly to this cable modem and it works as expected.
Also, I have attached a Diagnostics > States.
-
The traffic you're showing there is all outbound, initiated from your LAN.
Sites like canyouseeme only test TCP ports and it looks like you're expecting UDP, which won't come back as open on such sites (can't test UDP in that manner).
-
I am confused as to what to do.
Can pfsense port forward and if so how do I do this?
Is my WAN firewall listed in Reply #6 on Sept. 22 correct?
-
Can pfsense port forward and if so how do I do this?
Yeah. It works in 30 seconds for pretty much anyone but you. Click - click - click, done.
-
Thank you doktornotor for your support.
I am not sure what you're intent was but it certainly is not helpful to my problem.
Is someone willing to help me in a positive manor?
For example, doktornotor, you didn't answer if my WAN firewall rule is even correct or not?
-
Yes, your port forward/rule looks correct. That's why people keep pointing you here:
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting
Your problems is very likely something on that list.
-
Dude this really is click click!! Run through the troubleshooter if your having issues - it covers pretty much every single scenario that there is issues.
Really is 30 seconds.. Have something listening.. My ubuntu vm is listening on ssh on 192.168.1.7
I create a foward, let it create your firewall rule - go to canyouseeme, unless your testing udp that you can not check like that.. Create your forward with tcp first to something listening, rdp, ssh, ftp, http, anything!! On your box running the service do a netstat, do you see it listening (netstat works both linux and windows
