Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfsense, web server and VLAN's

    Scheduled Pinned Locked Moved General pfSense Questions
    web serverstatic ipvlanswitch
    42 Posts 4 Posters 8.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      If it's static and not trying to connect it won't appear in the ARP table until you try to ping it or connect to it some other way.

      If you connect to it from some other LAN client that traffic goes directly, it does not pass through pfSense, so it cannot be filtered by pfSense. If that is failing too it must be either something in the switch or a mismatch between the dynamic and static subnet config.

      Steve

      R 2 Replies Last reply Reply Quote 1
      • R
        Rockyuk @stephenw10
        last edited by

        @stephenw10 I will try abit later with the Switch I do think it is to do with that some how.

        1 Reply Last reply Reply Quote 0
        • R
          Rockyuk @stephenw10
          last edited by

          @stephenw10 Ok, I am trying to figure out my VLAN configuration on my Netgear ProSafe Gs105E

          Pfsense/Internet is coming in on port 5

          I have tagged port 2, 3 and 4 with VLAN ID’s

          Under Memberships on the Switch I have put u under port 2 & 5? But it is not bringing up the DHCP range from pfsense on port 2?

          Under Port PVID I have added the VLAN ID for the appropriate port is that correct?

          I am trying to do this offline while I configure everything to reduce downtime before the switch over i.e without a live WAN connection, will that impact the DHCP assignment coming from pfsense?

          Thanks

          Rockyuk

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            What VLAN(s) are configured in pfSense? They all have DHCP active?

            Probably going to need screenshots of the switch config to offer any advise there.

            I expect to see port 5 tagged and the access port(s) untagged on whatever vlan you are trying to use.

            Steve

            R 1 Reply Last reply Reply Quote 0
            • R
              Rockyuk @stephenw10
              last edited by

              @stephenw10 Hi Stephen, Ok here are the VLAN's configured

              pfSense-home-arpa-Interfaces-VLANs.png

              DHCP for one of the VLAN's

              pfSense-home-arpa-Interfaces-WebServer-re0-20-.png

              Dashboard

              pfSense-home-arpa-Status-Dashboard.png

              Switch

              NsdpClient_pWMcb9dCOq.png

              NsdpClient_MfgY7NlCLD.png

              I am now getting the correct DHCP served on each port but no internet connection now?

              Thanks

              Rockyuk

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                You probably need to add firewall rules to the 'webserver' interface. Only LAN is given a pass rule by default. Any additional interfaces need rules to be added to pass traffic.

                Steve

                R 1 Reply Last reply Reply Quote 0
                • R
                  Rockyuk @stephenw10
                  last edited by

                  @stephenw10 Could you provide an example please?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Something like:

                    Screenshot from 2022-04-10 21-17-03.png

                    Though you may want to get more refined. It depends what subnets need access to one another.

                    Steve

                    R 2 Replies Last reply Reply Quote 0
                    • R
                      Rockyuk @stephenw10
                      last edited by

                      @stephenw10 Thank you, I will give it a go and let you know.

                      1 Reply Last reply Reply Quote 0
                      • R
                        Rockyuk @stephenw10
                        last edited by

                        @stephenw10 Hi Stephen, I tried that and it worked briefly then stopped and started to stop resolving websites. Tried to bring up google and duckduckgo and nothing it did work for a few seconds then stopped.

                        pfSense-home-arpa-Firewall-Rules-WEBSERVER.png

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          That rule is passing TCP only, so DNS is not passed because it mainly uses DNS.

                          Set the protocol to 'any' as my example rule shows.

                          Steve

                          R 1 Reply Last reply Reply Quote 0
                          • R
                            Rockyuk @stephenw10
                            last edited by

                            @stephenw10 You are a star that worked thank you, last thing. With regards to the web server for incoming firewall rules for HTTPS, HTTP and DNS etc, as my websites SSL does not seem to be loading. Is the below rules correct for incoming on the web server?

                            pfSense-home-arpa-Firewall-Rules-WEBSERVER.png

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @Rockyuk
                              last edited by

                              @rockyuk said in pfsense, web server and VLAN's:

                              Is the below rules correct for incoming on the web server?

                              Huh? Those are not "incoming" to your webserver - those are incoming to the pfsense interface your calling webserver.

                              They would not have anything to do with something talking to some webserver on this network, from some other network.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Indeed for incoming traffic to the webserver from some external address the rules would need to be on the WAN interface.
                                If the WEBSERVER subnet is private you would also need port forward rules to allow that. By default the port forwards will add appropriate firewall rules when you add them anyway.
                                The source port on rules like that should almost always be 'any'. Only the destination port is the known value for the traffic you are passing.

                                In pfSense firewall rules apply to traffic coming into an interface. So for internal subnets that means traffic coming into the interface is from the hosts on that subnet to some other location outside the subnet.

                                Steve

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  Rockyuk @stephenw10
                                  last edited by

                                  @stephenw10 Apologies, I am new to all of this and probably not the easiest firewall for me to setup. So, I apologise if what I am doing does not make sense as I am learning as I go along. I have followed a lot of YouTube videos to get this far but I need a little more guidance on the Incoming Firewall rules for the web server.

                                  Could you post an example for a rule for either incoming DNS (53) or HTTPS please. As I am clearly stuck on this part. Thank you

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Add a port forward like this:

                                    Screenshot 2022-04-11 at 14-57-50 m400-2.stevew.lan - Firewall NAT Port Forward Edit.png

                                    Obviously change the 'Redirect target IP' to the internal address of your webserver.

                                    The 'Filter Rule Association' value there will create a matching firewall rule on WAN you will be able to see.

                                    Are you sure you want to allow external access to DNS on that machine? That's almost always a bad idea!

                                    Steve

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      Rockyuk @stephenw10
                                      last edited by

                                      @stephenw10 I think I have done it correctly thank you.

                                      Firewall Rules

                                      pfSense-home-arpa-Firewall-Rules-WAN.png

                                      NAT

                                      pfSense-home-arpa-Firewall-NAT-Port-Forward.png

                                      When I goto my website I it is not showing the SSL Certificate anymore and i get the following error

                                      Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding
                                      Try accessing the router by IP address instead of by hostname.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by stephenw10

                                        'WEBSERVER address' in that context refers to the address of the WEBSERVER interface which is wrong. The target IP needs to be the internal address of the actual web server in that subnet.

                                        Steve

                                        R 1 Reply Last reply Reply Quote 0
                                        • R
                                          Rockyuk @stephenw10
                                          last edited by

                                          @stephenw10

                                          NAT

                                          pfSense-home-arpa-Firewall-NAT-Port-Forward.png

                                          Firewall Rules

                                          pfSense-home-arpa-Firewall-Rules-WAN.png

                                          I am still unable to access my website as it is still bringing up the following

                                          Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding
                                          Try accessing the router by IP address instead of by hostname.

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Ah, that's because you are testing from inside the firewall so it's hitting the pfSense GUI.

                                            You need split DNS or NAT reflection if you want that to work:
                                            https://docs.netgate.com/pfsense/en/latest/recipes/port-forwards-from-local-networks.html

                                            But you should test from an external connection to be sure the port forward is working. So on your phone over LTE for example.

                                            Steve

                                            R 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.