i have a packet arriving at my router:
From Address: 6.139.8.216:58338 (the remote machine sending the packet)
To Address: 216.8.173.241:32538 (my router)
i'm trying to figure out the fate of this packet; was it blocked or if it was passed?
Note: i see the packet arrive using tcpdump:
>tcpdump -i2 -n -X -s0 "pppoes and host 6.139.8.216"which means:
- -i2: dump traffic on interface 2 (my WAN interface)
- -n: not not resolve DNS names
- -X: dump hex and printable ASCII of the packet
- -s0: set snaplen to zero, dumping entire packet with
-Xrather than just the first 82 bytes
By fate of the packet i mean:
- if it was passed: who was it NAT'ed to, and from what port?
- if it was blocked: why it was blocked (did it match a block rule? did it match no rule and was blocked by default?)
i can see the packet arrive in tcpdump, but i don't see any mention of it (or the rule it matches, or fails to match) in PFtop.
How can i figure out what's happening to this packet?
i don't have a static NAT rule for port 32538. But i do have the port NATed dynamically, as i can see in Diagnostics -> Show States:
Source -> Router -> Destination
192.168.1.98:57187 -> 216.8.173.241:32538 -> 65.55.158.118:3544
The careful observer will realize what i'm actually trying to debug here. i can give a hint by resolving the final destination address above:
Source -> Router -> Destination
192.168.1.98:57187 -> 216.8.173.241:32538 -> teredo.ipv6.microsoft.com:3544
Yes, i'm debugging Teredo. My client machine has a valid Teredo address:
2001:0000:4137:9e76:20bb:80e5:27f7:510d
A teredo address (i.e. 2001:0000:x:x:x:x:x:x:x) is encoded with:
- the Teredo server's IPv4 address: 65.55.158.118
- my Public IPv4 address: 216.8.173.241
- my external UDP port: 32538
The idea is that i have an active UDP nat state to teredo.ipv6.microsoft.com from port 32538. Now anyone on the internet should be able to dump a UDP packet to my port 32538, and it should be NATed back to my machine on the LAN.
Similar to how i open a TCP connection to superuser.com:80 from my port 32538 (e.g. web-request):
216.8.173.241:32538 ══> superuser.com:80
Any response from superuser.com, to the router's port 32538, will get NATed to my machine (i.e. web response):
216.8.173.241:32538 <══ superuser.com:80
This also means that anyone should be able to send me a packet on that port and it will get forwarded by pfSense to my internal desktop machine, since i have that NAT port (dynamically) open:
╔══superuser.com:80
216.8.173.241:32538 <══╣
╚══6.139.8.216:58338
Except that for some reason pfSense does not seem to be forwarding packets from other addresses; which is what i'm trying to debug where it's going wrong.
