If so, then you defeated the test by passing through the RDP pathway.
You must VPN out to the remote host.
The remote host must attempt to reach your PMS server’s WAN IP:forwarded-port
You should then see PMS respond (because the connection was made).
You have, what, three levels of firewall here?
– WAN/router port forward.
– IPtables
– UFW
I’m not busting your **** on this but if you have this for PMS, Isn’t that excessive ?
I’m asking because if a particular layer you have isn’t satisfying the need – do something else and drop the one which doesn’t.
I have two combined as one:
List of allowed remote IPs/FQDNs/DDNS names which are allowed to connect
NAT-port forward rule which only allows IP’s (real-time lookup) found in that list to pass.
If someone gets past that, then they’re spoofing my ISP (and getting away with it) and every other router in the internet. (they’ve broken BGP tables at the backbone core)
For things on my LAN, I use physical switching VLAN ID isolation.
If I don’t want two hosts to see each other then they’re not on the same VLAN.
( To me; VLAN is physical wiring and different than SUBNET which is addressing on that wiring. )
Run commands as posted… showing pass state as a connection “from the internet” back through the Public Facing IP of the pfsense router, through the NAT forwarding service, routing to the PMS system.
“… three levels of firewall here?..” → No. .just one… the pfsense.
– WAN/ → Fireawall table and filter rules based on unbound filter sets + other filters / rules
NAT —> router port forward. IF WAN from * proto TCP Port 32400 Forward LAN_VLAN100 IP 172.16.100.110 Proto TCP Port 32400
<10Gb Switch> ===> No ACL or filters just L2 repeater
– IPtables → PMS Host. Ubuntu 22.04 running plex 4.116.1
—– UFW -. nope. none enabled as noted in systemctl and iptables -F to denote kernel tables are Allow * from * to * all Proto
And as noted in tcp session / logs… From internet… session traveled that path to PMS host. Sooo… its not a forwarding or firewall, or lack of service listening.
– IPtables → PMS Host. Ubuntu 22.04 running plex 4.116.1
—– UFW -. nope. none enabled as noted in systemctl and iptables -F to denote kernel tables are Allow * from * to * all Proto
Not sure how to make it more clear…
root@pandora:/media/md0/containers# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
CILIUM_INPUT all -- anywhere anywhere /* cilium-feeder: CILIUM_INPUT */
KUBE-FIREWALL all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
CILIUM_FORWARD all -- anywhere anywhere /* cilium-feeder: CILIUM_FORWARD */
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
CILIUM_OUTPUT all -- anywhere anywhere /* cilium-feeder: CILIUM_OUTPUT */
KUBE-FIREWALL all -- anywhere anywhere
Chain CILIUM_FORWARD (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere /* cilium: any->cluster on cilium_host forward accept */
ACCEPT all -- anywhere anywhere /* cilium: cluster->any on cilium_host forward accept (nodeport) */
ACCEPT all -- anywhere anywhere /* cilium: cluster->any on lxc+ forward accept */
ACCEPT all -- anywhere anywhere /* cilium: cluster->any on cilium_net forward accept (nodeport) */
Chain CILIUM_INPUT (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere /* cilium: ACCEPT for proxy traffic */
Chain CILIUM_OUTPUT (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere /* cilium: ACCEPT for proxy return traffic */
ACCEPT all -- anywhere anywhere /* cilium: ACCEPT for l7 proxy upstream traffic */
MARK all -- anywhere anywhere /* cilium: host->any mark as from host */ MARK xset 0xc00/0xf00
Chain KUBE-FIREWALL (2 references)
target prot opt source destination
DROP all -- !127.0.0.0/8 127.0.0.0/8 /* block incoming localnet connections */ ! ctstate RELATED,ESTABLISHED,DNAT
Chain KUBE-KUBELET-CANARY (0 references)
target prot opt source destination
root@pandora:/media/md0/containers# systemctl status ufw
○ ufw.service - Uncomplicated firewall
Loaded: loaded (/lib/systemd/system/ufw.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:ufw(8)
PMS has no firewall enabled and … has service plex-media-server listening on tcp port 32400
That makes it clear. So WTF is it failing to pass on the inbound.
Here’s a test ??
put iperf3 on the host and let it run at port 5201 (it’s default). iperf3 -s in the terminal window so you can watch for connections.
On pfsense, make a port forward rule to machine_IP:5201 TCP.
No restrictions, No VLAN tagging. Just a Pass rule to allow it into the WAN and out
Here’s mine.. which is restricted to specific source IPs (I don’t want to be an iperf server for the world). Machine IP is 192.168.0.20 (My NAS / PMS box )
Then put iperf3 on your phone / whatever and hit your WAN IP.
If you’d like to completely rule out Plex to confirm your port forwarding and firewall rule sanity, you could try using a simple HTTP server (with PMS stopped). Python works well for this.
On the command line, create a new empty directory. Then, create and empty file within that directory (touch test file). Inside that directory, run: python3 -m http.server 32400
You should then be able to use something like canyouseeme.org to test reachability to your external IP:port to verify that it’s being forwarded. You should also be able to point a browser to your external IP:port to verify that it serves the contents of the directory you created (which is why it’s important that you do this in an otherwise empty directory).
(But I’d recommend following Chuck’s advice first and foremost.)
Next log I looked into was “Plex Media Server.log”
Jan 25, 2024 21:03:43.198 [139686411205432] DEBUG - Request: [172.16.100.32:16440 (Subnet)] GET /myplex/account (10 live) #b0 TLS GZIP Signed-in Token (plexnerd) (Microsoft Edge)
Jan 25, 2024 21:03:43.199 [139686538316600] DEBUG - Completed: [172.16.100.32:16440] 200 GET /myplex/account (10 live) #b0 TLS GZIP 0ms 4035 bytes (pipelined: 24)
Jan 25, 2024 21:03:43.701 [139686454483768] DEBUG - Request: [172.16.100.32:16440 (Subnet)] GET /myplex/account (10 live) #b1 TLS GZIP Signed-in Token (plexnerd) (Microsoft Edge)
Jan 25, 2024 21:03:43.703 [139686540426040] DEBUG - Completed: [172.16.100.32:16440] 200 GET /myplex/account (10 live) #b1 TLS GZIP 1ms 4035 bytes (pipelined: 25)
Jan 25, 2024 21:03:44.208 [139686413314872] DEBUG - Request: [172.16.100.32:16440 (Subnet)] GET /myplex/account (10 live) #b2 TLS GZIP Signed-in Token (plexnerd) (Microsoft Edge)
Jan 25, 2024 21:03:44.210 [139686538316600] DEBUG - Completed: [172.16.100.32:16440] 200 GET /myplex/account (10 live) #b2 TLS GZIP 1ms 4035 bytes (pipelined: 26)
Jan 25, 2024 21:03:44.213 [139686540426040] DEBUG - [EventSourceClient/pubsub/45.79.197.58:443] EventSource: Got event [data] '<Message address="108.234.147.234" port="32400" asyncIdentifier="e23c6623-68cc-4e55-94ce-2700ae283cbd" connectivity="0" command="notifyConnectivity"/>'
Jan 25, 2024 21:03:44.213 [139686540426040] DEBUG - [EventSourceClient/pubsub/45.79.197.58:443] PubSub: Got notified of reachability for async identifier e23c6623-68cc-4e55-94ce-2700ae283cbd: 0 for 106.231.147.232:32400 (responded in 5253 ms)
Jan 25, 2024 21:03:44.214 [139686540426040] DEBUG - [EventSourceClient/pubsub/45.79.197.58:443] MyPlex: reachability check - current mapping state: 'Not Mapped'.
Jan 25, 2024 21:03:44.214 [139686540426040] DEBUG - [EventSourceClient/pubsub/45.79.197.58:443] MyPlex: inaccessibility report ignored because NAT punch is still pending.
Jan 25, 2024 21:03:44.219 [139686454483768] DEBUG - Request: [172.16.100.32:16440 (Subnet)] GET /myplex/account (10 live) #b3 TLS GZIP Signed-in Token (plexnerd) (Microsoft Edge)
Jan 25, 2024 21:03:44.220 [139686538316600] DEBUG - Completed: [172.16.100.32:16440] 200 GET /myplex/account (10 live) #b3 TLS GZIP 1ms 4035 bytes (pipelined: 27)
Jan 25, 2024 21:03:44.696 [139686415424312] DEBUG - Request: [172.16.100.32:16440 (Subnet)] GET /myplex/account (10 live) #b6 TLS GZIP Signed-in Token (plexnerd) (Microsoft Edge)
Jan 25, 2024 21:03:44.698 [139686540426040] DEBUG - Completed: [172.16.100.32:16440] 200 GET /myplex/account (10 live) #b6 TLS GZIP 1ms 4035 bytes (pipelined: 28)
Jan 25, 2024 21:03:45.206 [139686413314872] DEBUG - Request: [172.16.100.32:16440 (Subnet)] GET /myplex/account (10 live) #b7 TLS GZIP Signed-in Token (plexnerd) (Microsoft Edge)
Jan 25, 2024 21:03:45.208 [139686538316600] DEBUG - Completed: [172.16.100.32:16440] 200 GET /myplex/account (10 live) #b7 TLS GZIP 1ms 4035 bytes (pipelined: 29)
<snip>
Jan 25, 2024 21:03:11.734 [139686601677456] DEBUG - MyPlex: using cached data for request for https://plex.tv/api/v2/server/users?auth_token=xxxxxxxxxxxxxxxxxxxx
Jan 25, 2024 21:03:11.734 [139686498638648] DEBUG - [MediaProviderManager/HCl#d] HTTP requesting GET https://plex.tv/media/providers?X-Plex-Token=xxxxxxxxxxxxxxxxxxxx
Jan 25, 2024 21:03:11.735 [139686601677456] DEBUG - MyPlex: using cached data for request for https://plex.tv/api/v2/server/users/subscriptions?auth_token=xxxxxxxxxxxxxxxxxxxx
Jan 25, 2024 21:03:11.735 [139686601677456] DEBUG - MyPlex: using cached data for request for https://plex.tv/api/v2/server/users/services?auth_token=xxxxxxxxxxxxxxxxxxxx
Jan 25, 2024 21:03:11.737 [139686601677456] DEBUG - MyPlex: using cached data for request for https://plex.tv/api/v2/user?includeSubscriptions=1&includeProviders=1
Jan 25, 2024 21:03:11.737 [139686601677456] DEBUG - MyPlex: username is plexnerd, login is nobody.nobody@gmail.com, home is 1, no pin
Jan 25, 2024 21:03:11.740 [139686601677456] DEBUG - MyPlex: start public ip check and mapping - current mapped state: 'Unknown'.
Jan 25, 2024 21:03:11.740 [139686601677456] DEBUG - MyPlex: mapping state set to 'Not Mapped'.
Jan 25, 2024 21:03:11.740 [139686601677456] DEBUG - PublicAddressManager: Starting.
Jan 25, 2024 21:03:11.740 [139686601677456] DEBUG - PublicAddressManager: Obtaining public address and mapping port.
Jan 25, 2024 21:03:11.740 [139686509464376] DEBUG - PublicAddressManager: Obtaining public IP.
Jan 25, 2024 21:03:11.740 [139686509464376] DEBUG - [HCl#e] HTTP requesting GET https://v4.plex.tv/pms/:/ip
Jan 25, 2024 21:03:11.740 [139686454483768] DEBUG - [HCl#f] HTTP requesting GET https://plex.tv/api/v2/user?includeSubscriptions=1&includeProviders=1
Jan 25, 2024 21:03:11.740 [139686601677456] DEBUG - NetworkInterface: Starting watch thread.
Second part of log was snip that looked like communication to public Plex system to register IP… and that… is at bottom of log. Seems ok But that is only place that jumped out as to target IP .
And as for question of blocking non-US. Yes. I block all non-US sites.
I built Aliase rule to match yours and as plex.tv host was in list… I assume this is catch all for registration hosts.
