Ssh – pfsense: port forwarding rule allow open port but looks close

PFSense has a fre default rules regarding where traffic can come from on the WAN interface.

For example, you can tell it to drop any traffic on the WAN that has a private IP address (192.168, 10.0 or 172.0), because in a lot of scenarios you should never see a private IP on the WAN. However, also in a lot of cases you WOULD (if the pfSense is sitting INSIDE a network, rather than on the edge).

It will also block IP ranges that are not officially allocated to anyone, as they're supposedly never meant to be seen in the wild.

You can turn these options off under the Advanced menu in Configuration (I think it is, off the top of my head), or possibly in the WAN configuration screen.

I'm going to suggest that these two options are the place to start, because for whatever reason the traffic may be originating from a private IP range (mail filter, virus scanner, whatever) but hitting the WAN port, OR, a fresh block of IP ranges has been allocated and PFSense is not up to date with its listings.

A fair amount of testing (see comments) has revealed that you don't have a firewall or transport problem. The client is able to connect through to pptpd on the server, and any remaining issues are application-related (and I see you've opened a separate question for that).

In passing, I'd echo Jiri's comments about nmap; it's not a good tool for testing end-to-end connectivity on a single port; telnet serverip 1723 would've been much better.

I'm only writing this up so you can accept an answer and prevent this question from floating around like a ghost ship, forever; and because negative answers are useful, too, and the diagnostic process shown may be of use to someone else at some future date.