SOLVED: Troubleshooting port forwarding

[jafinn]

I'm actually not quite sure where to start troubleshooting this and could use some guidance to get started.

I've had port forwarding on my OPNsense box working now for years. I haven't touched the rules but might have touched some other setting.. The port forwards are to multiple machines on my network so it is unlikely that I messed up all of them at the same time:)

I've tried the really basic stuff, rebooting, removing and adding the rule. I could of course try to roll back but I've changed a lot of settings in HAproxy and the LetsEncrypt plugin so that's mainly what's in my history.

Local IP:port works so the machines respond on LAN. My WAN address also responds as long as I'm connected to my LAN but not from WAN.. So the rule works with NAT reflection but not NAT? This is what puzzles me, why does it work internally but not externally?


Can anyone spot an obvious mistake? This one for example for Plex



And my advanced firewall settings

[jafinn]

I've tried to do some more testing and if I add an IPv6 rule to forward ICMP to one of my hosts it works, the same rule for IPv4 doesn't respond.

The only trace I can see in the logs from the IPv4 ping is two different hits on WAN and LAN with "let out anything from firewall host itself". I can't see any incoming packets being blocked (or allowed for that matter). The source in the LAN hit is my external IP and the destination on the WAN one is the same external IP.

Since the IPv6 works fine and the ICMPv4 traffic appears in my logs as allowed I'm assuming this is most likely a NAT/routing issue? Any suggestion would be highly appreciated:)

[jafinn]

Finally found something helpful:)

Seems it is related to this issue https://forum.opnsense.org/index.php?topic=7132.0. Setting manual outbound NAT rules worked.

[franco]

Thanks for posting the solution. The particular issue in the thread you reference was fixed in 18.1.6.


Cheers,
Franco

[walkerx]

Also look at my post here where I was having similar issues.

I was recommended to also make a change to unbound dns, see this post

plex has since been working fine