[SOLVED]Port forward problem

Jailer

Got some new hardware and I'm having trouble getting port forawrding to work. I've tried restoring from a config backup and that doesn't work. I've also tried manually reconfguring everything and that doesn't work either. Also for some reason traffic from my jails on my freenas is being blocked as well.

All of this worked fine on my old machine.

I've enabled logging of the port forward rule as listed in the troubleshooting docs. When I try to check the port to see if it's open this is the result:


Interface	Protocol	Source -> Router -> Destination	State	Packets	Bytes	
WAN	tcp	192.168.0.224:80 (my_wan_IP:80) <- 198.199.98.246:43573	CLOSED:SYN_SENT	2 / 0	120 B / 0 B	
WAN	tcp	192.168.0.224:80 (my_wan_IP:80) <- 198.199.98.246:43576	CLOSED:SYN_SENT	2 / 0	120 B / 0 B	
WAN	tcp	192.168.0.224:80 (my_wan_IP:80) <- 198.199.98.246:43578	CLOSED:SYN_SENT	2 / 0	120 B / 0 B

I really don't know where to go from here. I've tried installing 2.2.6 and 2.3 both fresh installs and trying a config restore and nothing is working. I even tried nothing but 2 port forwards on a fresh install and they don't work either. Attached is my port forwards. I host a small private forum from home so I need to get this working so any help with this would be appreciated.
![port forward.jpg](/public/imported_attachments/1/port forward.jpg)
![port forward.jpg_thumb](/public/imported_attachments/1/port forward.jpg_thumb)

divsys

Any chance your ISP/something upstream of pfSense is blocking/mangling those external ports?

Try forwarding something out of the ordinary (9080 for eg.) to internal 80 on 192.168.0.224 and see if it makes a difference.

Jailer

No it's not my ISP. I have a static public IP address. I can hook up my old machine and everything works correctly. I move the cables to the new machine and the port forwards don't work and all my jail traffic is blocked.

Jailer

Just for kicks I tried the 32 bit version and it was a no go as well. I'm going to try picking up a different NIC card and see if that works.

You'd think the on board Intel's would be fine but who knows.

johnpoz

Did you sniff on your 192.168.0.224 and see if it got the packet?

Jailer

@johnpoz:

Did you sniff on your 192.168.0.224 and see if it got the packet?

I did but it's pretty much greek to me trying to read a packet capture. I doubt it made it as I don't have any connectivity outbound from my jails either. The 192.168.0.224 is the jail that I'm forwarding the ports to.

Could it possibly be the on board NIC's that are the problem? The board is a Supermicro X7SBE with 2 Intel NIC's; 82573V and 82573L.

cmb

CLOSED:SYN_SENT means the traffic was sent to the internal host, and it didn't reply. Look at things specific to that host. Most likely, common problems 2, 3 or 4 here.
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

Jailer

@cmb:

CLOSED:SYN_SENT means the traffic was sent to the internal host, and it didn't reply. Look at things specific to that host. Most likely, common problems 2, 3 or 4 here.
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

From the troublshooting guide:

Number 2: Ports were checked externally from this site and all the ports that I set up forwards for show as closed. I also checked with my phone and I was not able to connect to my Plex server as well confirming that the port forward I have set up for this is not working.

Number 3: I did this. I don't know what exactly I'm looking for here. I can't tell if the traffic is passing or being blocked. I'm not asking anyone to hold my hand and walk me through this but can someone point me in the right direction so I can at least try and educate myself on how to decipher the logs.

Number 4: The text in code tags in my original post is the result of completing this step.

I tried pinging google from all of my jails. None of my jails on my FreeNAS machine have internet connectivity. FreeNAS itself does. If I hook my current hardware that is running 2.2.6 back up everything works. A fresh install on new hardware does not.

I have ordered an Intel Pro 1000 on the outside chance that pfsense isn't playing nice with the on board NIC's. Other than that I'm stumped and don't know what else to try. :-\

cmb

It has nothing to do with the NICs, that wouldn't make some things work fine, and other devices not. There is something on 192.168.0.224 that's preventing it from replying.

#2 3 or 4 under common problems, sounds like you're not looking at the right list.

Jailer

That could very well be. So basically a non response from a host on a forwarded port would interpreted by an external testing site as closed? Am I understanding this correctly? If that's the case then the fact that my jails don't have internet access would be the cause of the problem? Just thinking out loud here….

So what would cause my jails to lose internet connectivity just by switching hardware when the host FreeNAS machine doesn't and the network configuration hasn't changed?

ETA: One thing I didn't try was restarting the jails or rebooting the FreeNAS box but I don't see how that would make a difference.

cmb

yes it's almost certainly the same reason. Probably missing/wrong default gateway if I had to guess.

Jailer

Good lord the time I've wasted on this. I rebooted the jail and it started responding so I rebooted the server and everything is working now.

Sorry for the stupid post, it was PEBCAK.