[FIXED] Help needed with forwarding UDP traffic with pfSense - Page 1
Forum section: electronics / general

author: Ampera
author_rank: Super Contributor
timestamp: November 18, 2018, 04:12:12 pm
content: Alright, so my router is something I whipped up with pfSense, it works great, and does NAT/port forwarding using TCP just fine, but for whatever reason, it doesn't work on UDP.So here's the setup, I have a computer running a server listening for UDP traffic on port 27015, connecting to this server over the local network works perfectly fine, but connecting to it over the internet doesn't seem to work.Running a packet capture for all LAN or WAN traffic shows packets going out from the client, into WAN, and back into the server, so the router believes there is traffic going through, and there even appears to be UDP packets being sent by the server to the client, but there is no log on the server of this happening, and no connection can be made. There is no firewall on either the client nor server computers.The port forward is set up for the WAN interface, destination WAN address, with a port range of 27015 to 27015 (just 27015), redirecting target IP to the server's LAN address, and on the same port. This was set up originally for just UDP traffic, but even using both UDP/TCP doesn't do anything different (obviously as my server software doesn't use TCP).I have no clue what's missing here, the router supposedly shows that the traffic is going through, but nothing is happening as far as the server sees. Client and server both run most recent (updated within a few days of now) versions of Arch Linux, and the server software is HLDS.

author: helius
author_rank: Super Contributor
timestamp: November 18, 2018, 05:04:54 pm
content: Your description isn't really clear. You're saying that you have a client and a server on the same LAN, behind a router doing NAT to the Internet, and you can't connect from the client to the server by pointing to the router's WAN address?This is expected behavior. The router can't forward a packet out and back in again, that would be a routing loop.Or, look at it this way. The router NAT is providing an Internet address (on the WAN) as a proxy to machines on the local network. Each port on that WAN address can be associated with only one local machine at a time. It cannot ever be associated with Machine A sending packets to Machine B, since that would require both A and B to both be associated with the same port.TCP and UDP aren't the issue, this is an IP L3 issue.

author: Ampera
author_rank: Super Contributor
timestamp: November 18, 2018, 06:22:17 pm
content: The thing is I can do this with, for example, an HTTP server no problem, and I've been able to do this before as well with UDP on a different router, so I'm still thinking it's something I'm doing wrong.I'm calling in a friend to possibly see if what you say is true, and if it's visible to other people outside my network.

author: Ampera
author_rank: Super Contributor
timestamp: November 18, 2018, 07:28:43 pm
content: Well, you turn out to be right. Other can apparently connect via WAN, just not me. Thanks for clarifying this, I get confused almost instantly with networking.

author: alm
author_rank: Super Contributor
timestamp: November 18, 2018, 11:33:39 pm
content: Quote from: helius on November 18, 2018, 05:04:54 pmWhat are you talking about? NAT involves rewriting the source and/or destination address, and keeping track of the original address. There's no reason why this has to cause a routing loop: it usually takes place before hitting the routing table. See the section "Redirection and Reflection" in thePF FAQ. This may or may not apply exactly to the PF version in pfSense.

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 18, 2018, 11:52:40 pm
content: If you want a device at home to behave like it's "away from home", use a VPN service like ProtonVPN.