Nodes relaying behind pfSense firewall while other firewall vendors have nodes directly connect

[northport]

Hi Everyone,

I’m running into an issue with all nodes behind a pfSense firewall relaying while other nodes behind all other firewall vendors have direct connections with each other. I’m self-hosting the network controller with Zero-UI. While ZT central as the network controller has all nodes with a direct connection. Any thoughts?

pfSense settings:

• Hybrid NAT
• UPNP disabled
• No port blocks to 9993

Other routers:

• Default NAT
• UPNP disabled
• No port blocks to 9993

Thanks for your help.

[alepaes]

Same problem here. Sometimes the node become OFFLINE, but I see the packets Out and In to the exposed ports.
Sometimes, node become RELAYED.
In other firewalls, all ok.
I described my problem in another post: Diagnosing an OFFLINE machine - #9 by alepaes

[zt-grant]

If I recall correctly, pfSense’s default NAT type out of the box is a Symmetric NAT, though it has been a while since I’ve looked. What symmetric NAT does is it creates a new NAT port for each local <-> remote host combination. For example:

Local	NAT port	Remote
10.0.0.23	23452	8.8.8.8
10.0.0.23	25453	1.1.1.1

This makes the root servers largely ineffective for finding peers, unless relaying. This is because the root sees the node at port 25453, but no other machines running zerotier can contact that node on that port of the pfSense box