• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

pfsense, web server and VLAN's

Scheduled Pinned Locked Moved General pfSense Questions
web serverstatic ipvlanswitch
42 Posts 4 Posters 11.3k Views 3 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S Offline
    stephenw10 Netgate Administrator
    last edited by Apr 11, 2022, 1:22 PM

    Indeed for incoming traffic to the webserver from some external address the rules would need to be on the WAN interface.
    If the WEBSERVER subnet is private you would also need port forward rules to allow that. By default the port forwards will add appropriate firewall rules when you add them anyway.
    The source port on rules like that should almost always be 'any'. Only the destination port is the known value for the traffic you are passing.

    In pfSense firewall rules apply to traffic coming into an interface. So for internal subnets that means traffic coming into the interface is from the hosts on that subnet to some other location outside the subnet.

    Steve

    R 1 Reply Last reply Apr 11, 2022, 1:51 PM Reply Quote 0
    • R Offline
      Rockyuk @stephenw10
      last edited by Apr 11, 2022, 1:51 PM

      @stephenw10 Apologies, I am new to all of this and probably not the easiest firewall for me to setup. So, I apologise if what I am doing does not make sense as I am learning as I go along. I have followed a lot of YouTube videos to get this far but I need a little more guidance on the Incoming Firewall rules for the web server.

      Could you post an example for a rule for either incoming DNS (53) or HTTPS please. As I am clearly stuck on this part. Thank you

      1 Reply Last reply Reply Quote 0
      • S Offline
        stephenw10 Netgate Administrator
        last edited by Apr 11, 2022, 2:01 PM

        Add a port forward like this:

        Screenshot 2022-04-11 at 14-57-50 m400-2.stevew.lan - Firewall NAT Port Forward Edit.png

        Obviously change the 'Redirect target IP' to the internal address of your webserver.

        The 'Filter Rule Association' value there will create a matching firewall rule on WAN you will be able to see.

        Are you sure you want to allow external access to DNS on that machine? That's almost always a bad idea!

        Steve

        R 1 Reply Last reply Apr 11, 2022, 2:24 PM Reply Quote 0
        • R Offline
          Rockyuk @stephenw10
          last edited by Apr 11, 2022, 2:24 PM

          @stephenw10 I think I have done it correctly thank you.

          Firewall Rules

          pfSense-home-arpa-Firewall-Rules-WAN.png

          NAT

          pfSense-home-arpa-Firewall-NAT-Port-Forward.png

          When I goto my website I it is not showing the SSL Certificate anymore and i get the following error

          Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding
          Try accessing the router by IP address instead of by hostname.

          1 Reply Last reply Reply Quote 0
          • S Offline
            stephenw10 Netgate Administrator
            last edited by stephenw10 Apr 11, 2022, 2:28 PM Apr 11, 2022, 2:28 PM

            'WEBSERVER address' in that context refers to the address of the WEBSERVER interface which is wrong. The target IP needs to be the internal address of the actual web server in that subnet.

            Steve

            R 1 Reply Last reply Apr 11, 2022, 3:03 PM Reply Quote 0
            • R Offline
              Rockyuk @stephenw10
              last edited by Apr 11, 2022, 3:03 PM

              @stephenw10

              NAT

              pfSense-home-arpa-Firewall-NAT-Port-Forward.png

              Firewall Rules

              pfSense-home-arpa-Firewall-Rules-WAN.png

              I am still unable to access my website as it is still bringing up the following

              Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding
              Try accessing the router by IP address instead of by hostname.

              1 Reply Last reply Reply Quote 0
              • S Offline
                stephenw10 Netgate Administrator
                last edited by Apr 11, 2022, 3:21 PM

                Ah, that's because you are testing from inside the firewall so it's hitting the pfSense GUI.

                You need split DNS or NAT reflection if you want that to work:
                https://docs.netgate.com/pfsense/en/latest/recipes/port-forwards-from-local-networks.html

                But you should test from an external connection to be sure the port forward is working. So on your phone over LTE for example.

                Steve

                R 1 Reply Last reply Apr 11, 2022, 3:36 PM Reply Quote 0
                • R Offline
                  Rockyuk @stephenw10
                  last edited by Apr 11, 2022, 3:36 PM

                  @stephenw10 That worked thank you, still not able to bring up website keeps timing out

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    stephenw10 Netgate Administrator
                    last edited by Apr 11, 2022, 3:39 PM

                    Check the state table in Diag > States whilst you're testing.

                    If you see the states open on WAN and WEBSERVER for the IP you're testing from then pfSense is forwarding it correctly. It could be the server is rejecting the external traffic.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • S Offline
                      stephenw10 Netgate Administrator
                      last edited by Apr 11, 2022, 4:09 PM

                      Looks good now whatever you did. 😉

                      R 1 Reply Last reply Apr 11, 2022, 10:55 PM Reply Quote 0
                      • R Offline
                        Rockyuk @stephenw10
                        last edited by Apr 11, 2022, 10:55 PM

                        @stephenw10 Ok, I am getting offline and 100% packet loss on my Gateway.

                        No traffic is getting through to Web Server either, I thought it might have been my software firewall on web server CSF. I disabled it and still nothing!

                        J 1 Reply Last reply Apr 11, 2022, 11:26 PM Reply Quote 0
                        • J Offline
                          johnpoz LAYER 8 Global Moderator @Rockyuk
                          last edited by Apr 11, 2022, 11:26 PM

                          @rockyuk said in pfsense, web server and VLAN's:

                          I am getting offline and 100% packet loss on my Gateway.

                          Which gateway - how are you posting here if your internet is down? Nothing could get to pfsense wan if its gateway is down..

                          There should only be a "gateway" set on your actual internet connection "wan"

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 25.07 | Lab VMs 2.8, 25.07

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            stephenw10 Netgate Administrator
                            last edited by Apr 11, 2022, 11:33 PM

                            It works for me. Traffic to that IP is being forwarded to a webserver. I see:

                            Screenshot from 2022-04-12 00-32-07.png

                            Is that not correct? How are you testing?

                            Steve

                            R 1 Reply Last reply Apr 11, 2022, 11:40 PM Reply Quote 0
                            • R Offline
                              Rockyuk @stephenw10
                              last edited by Apr 11, 2022, 11:40 PM

                              @stephenw10 I have switched it back to my normal connection I can't leave it on the Firewall as it is not resolving. So i have to switch between the two to keep my Web Server up.

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                stephenw10 Netgate Administrator
                                last edited by Apr 12, 2022, 12:02 AM

                                Mmm, Ok well nothing is going to work incoming whilst the gateway is down.

                                I assume it was up earlier? What changed?

                                R 1 Reply Last reply Apr 12, 2022, 12:05 AM Reply Quote 0
                                • R Offline
                                  Rockyuk @stephenw10
                                  last edited by Apr 12, 2022, 12:05 AM

                                  @stephenw10 I still get internet even when it is down which is weird. But i am wondering if it is that which is causing the routing issue with the server?

                                  I don't think it ever came online, even when it says it is offline I still manage to get internet access.

                                  1 Reply Last reply Reply Quote 0
                                  • S Offline
                                    stephenw10 Netgate Administrator
                                    last edited by Apr 12, 2022, 12:15 AM

                                    What is the gateway? It may not respond to the monitoring pings.

                                    Try editing it in System > Routing > Gateways and setting an alternative monitoring IP like 8.8.8.8.

                                    R 1 Reply Last reply Apr 12, 2022, 10:06 AM Reply Quote 0
                                    • R Offline
                                      Rockyuk @stephenw10
                                      last edited by Apr 12, 2022, 10:06 AM

                                      @stephenw10 Ok, adding the 8.8.8.8 to the Gateway worked for keeping that up now. I have done a quick packet capture on the WAN and Web Server Interface which i zipped up a PDF file below.

                                      Packet Capture.zip

                                      STATES

                                      pfSense-home-arpa-Diagnostics-States-States (1).png

                                      ROUTES

                                      pfSense-home-arpa-Diagnostics-Routes.png

                                      The gateway that was provided by my ISP does not seem to be coming up on pfsense and it is pulling in it's own DNS servers from my ISP. Not sure if that will cause an issue but it is not what i have on my current setup. The traffic is not being routed from WAN to Web Server interface and i can't understand why.

                                      1 Reply Last reply Reply Quote 0
                                      • S Offline
                                        stephenw10 Netgate Administrator
                                        last edited by Apr 12, 2022, 12:43 PM

                                        Hmm, some conflicting results here.

                                        The state table shows traffic being correctly sent to the webserver but there are no replies shown on any of those states as though the server is refusing the connection.

                                        The WAN pcap doesn't show any inbound traffic on port 443 at all. It on;y covers ~4s though you probably need to filter by the external IP you're testing from.

                                        The WEBSERVERS pcap shows successful two way traffic to the server though:

                                        10:45:02.447710 IP 82.132.215.99.49926 > 192.168.0.100.443: tcp 0
                                        10:45:02.447879 IP 192.168.0.100.443 > 82.132.215.99.49926: tcp 0
                                        10:45:02.458748 IP 82.132.215.99.49926 > 192.168.0.100.443: tcp 517
                                        10:45:02.459162 IP 192.168.0.100.443 > 82.132.215.99.49926: tcp 0
                                        10:45:02.461764 IP 192.168.0.100.443 > 82.132.215.99.49926: tcp 1356
                                        10:45:02.461868 IP 192.168.0.100.443 > 82.132.215.99.49926: tcp 384
                                        10:45:02.473285 IP 82.132.215.99.49926 > 192.168.0.100.443: tcp 0
                                        

                                        Steve

                                        R 1 Reply Last reply Apr 12, 2022, 1:04 PM Reply Quote 0
                                        • R Offline
                                          Rockyuk @stephenw10
                                          last edited by Apr 12, 2022, 1:04 PM

                                          @stephenw10 Do you think it is the server rejecting it then? I disabled the software firewall on it and still was not passing to it. I will try a quick test now by disabling the software firewall on it and do another packet trace.

                                          1 Reply Last reply Reply Quote 0
                                          37 out of 42
                                          • First post
                                            37/42
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received