Problems receiving DCC transfers (pfSense firewall) reddit / irc ---------------------------------------------------------------------- xthursdayx · 2020-07-05 21:12 Hi all, every since I upgraded my firewall/router to pfSense I have been unable to receive DCC file transfers. I've tried using both Limechat and Textual. I have both clients set to receive DCC on ports 1136-1146, having created port forwards for these ports to the machine running the clients, have created firewall rules to allow connections both inbound and outbound from these ports on my host machine, have created an NAT Outbound rule making outbound connections from the host machine on ports 1136-1146 use a static port on WAN, and have even enabled UPnP for the host machine at ports 1136-1146. Yet still any time a DCC transfer is initiated with me it fails once I start it with the error message "connection refused". Any ideas about what I might be missing? Thanks! ---------------------------------------------------------------------- evolvingfridge · 2020-07-06 03:38 Assuming pfsense logging is enabled, I would check firewall logs first, and go from there. ---------------------------------------------------------------------- I-am-fun-at-parties · 2020-07-06 18:27 Have you considered using tcpdump or Wireshark? ---------------------------------------------------------------------- xthursdayx · 2020-07-07 19:54 I'm open to that, but I don't really have any experience using either. Would I need to run both/either on a separate machine? ---------------------------------------------------------------------- evolvingfridge · 2020-07-07 21:40 Based on your description of a problem, you need firewall logs and not sockets logs on the host machine. ---------------------------------------------------------------------- I-am-fun-at-parties · 2020-07-07 21:43 You'd run one of them (Wireshark if it's Windows, tcpdump if it's anything unixlike) on the machine that runs your client, and if you can, also on the pfSense box (and if you control the other end of the DCC connection too, can't hurt to run it there as well). The idea is to capture your network traffic on as many involved stations as possible so you can get an idea of what goes wrong by comparing what you see with what you'd expect to see. If memory serves, DCC starts with a CTCP message (a glorified regular private message on IRC) telling the other end your IP address and a port to use; then the other end will try to connect there, so you should check if a) your client tells the other end the correct IP address, and b) if so whether the connection request from the other end actually arrives at your computer. If it doesn't check if it arrives at your pfSense box at least, and if it doesn't do that either, the issue is on the other end. ---------------------------------------------------------------------- xthursdayx · 2020-07-08 19:56 Okay, so I was able to get this working by paying close attention to my firewall logs while purposely failing DCC transfers, it seems that for whatever reason neither IRC client (Textual and Limechat) are actually using the port range I set for DCC. The DCC connections were failing because they were leaving my host machine at a different port that is blocked by some default block rules I have for the LAN the host machine is on. All of the outbound static port rules, port forwards, etc were in place just fine, but the problem was at the level of my host machine (or the IRC software itself). So, I've got it working, but it would be nice to know why these connection are not actually being made on the ports I specified in the IRC client. ---------------------------------------------------------------------- evolvingfridge · 2020-07-10 21:04 > some default block rules I have for the LAN the host machine is on. Most likely your firewall is poorly configured. ---------------------------------------------------------------------- xthursdayx · 2020-07-12 04:21 That doesn’t really help me much tbh. I followed detailed guides when setting up my firewall originally and have had my firewall rules reviewed by other folks who suggested that they looked good. As my previous post indicated the issue seems to be that the IRC programs aren’t actually using the port of my host machine I set them up to use. If you have a suggestion for what you think I could change to try to address the problem then I would be happy to try that out.