Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Just trying to forward 443 to an internal server

    Scheduled Pinned Locked Moved NAT
    55 Posts 4 Posters 9.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      combat_wombat27 @johnpoz
      last edited by

      @johnpoz Okay, I really feel like I'm going crazy here. I would have sworn I saw the packet trace show the firewall received the packets and pasted a screenshot in chat. That must have been inaccurate as I don't see anything. That said, if packets weren't making it to the WAN side interface then how am I able to open up the Web GUI on 443 when enabled.

      C 1 Reply Last reply Reply Quote 0
      • C
        combat_wombat27 @combat_wombat27
        last edited by

        @combat_wombat27 even more interesting. Even though I had tested and remade my NAT rule already, I noticed the 4443 NAT as a test worked. So I just adjusted it back to 443 and it started working.

        I still don't understand how I wouldn't be seeing the packets externally if they were making it at least to the firewall. Maybe someone can explain that feat to me.

        Anyways, it is working currently.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @combat_wombat27
          last edited by johnpoz

          @combat_wombat27 said in Just trying to forward 443 to an internal server:

          I still don't understand how I wouldn't be seeing the packets externally if they were making it at least to the firewall

          You were not sniffing correctly. You had a filter wrong? You had the wrong interface? etc?

          So do you access the forum via the same IP? Because I don't get any response hitting that IP on 443.

          But you say its working? If it was working you would see a successful test on can you see me . org

          works.jpg

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          C 1 Reply Last reply Reply Quote 0
          • C
            combat_wombat27 @johnpoz
            last edited by

            @johnpoz I don't think the filter was wrong as the only difference in the filter I used for testing 4443 was to change the port from 443 to 4443. From there it showed traffic on 4443 just fine. I then switched it back to 443 and did not see the packets reach the firewall.

            Yes, it is working and yes I got a Success. No, we are an MSP so we are not at the site where this was being deployed.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @combat_wombat27
              last edited by

              @combat_wombat27 said in Just trying to forward 443 to an internal server:

              I then switched it back to 443 and did not see the packets reach the firewall.
              it is working and yes I got a Success

              Well there is piece of the puzzle missing because what your saying isn't possible - how would you access 443, if you are not seeing the traffic?

              Your saying its working - so there would be state showing that, etc. If your creating a state, how would you not being seeing the traffic via a sniff - unless your sniff was not actually sniffing on the correct interface, or wrong port or some other error, etc.

              When you sniff on wan, do you see other traffic?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              C 1 Reply Last reply Reply Quote 0
              • C
                combat_wombat27 @johnpoz
                last edited by

                @johnpoz Yeah. I'm agreeing with you. I don't know how this situation can be factual. I would assume I messed up the capture, but it worked just fine with 4443 just with the port changed.
                I do see other traffic on the WAN yes.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @combat_wombat27
                  last edited by

                  @combat_wombat27 said in Just trying to forward 443 to an internal server:

                  I do see other traffic on the WAN yes.

                  Then how could you not see the 443 traffic if its working, because clearly the sniff is working. But its just not capturing 443 - that makes no sense at all.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    combat_wombat27 @johnpoz
                    last edited by combat_wombat27

                    @johnpoz I'm as confused as you are or more. All I know is what I've seen so far.
                    698ff4e4-07e5-4e58-aca5-1e68f70fb0ec-image.png

                    ebd45433-5d17-46a6-8462-225b1be5cc0d-image.png
                    Can you tell me what is wrong with that config?
                    I double-checked the IP address and everything.
                    I see other packets go by when I scan, but even though the scan is a success I don't see the packets I would expect. Perhaps you can see something I cannot?

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @combat_wombat27
                      last edited by

                      @combat_wombat27 couple of things, maybe its udp.. https can go via udp if using quic

                      You sure its not coming in via IPv6? Do you have other internet connections other than wan?

                      Did you actually start it? Should be showing you last start time, etc..

                      capture.jpg

                      Odd that your only seeing last capture? What version of pfsense are you on?

                      You sure that is the right source IP? If your saying its working, look in your state table for what the public IP Is that is hitting it when you say its working..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        combat_wombat27 @johnpoz
                        last edited by

                        @johnpoz I turned on any for both ipv4 and 6 and UDP etc as well as TCP. I saw 0 ipv6 traffic. That one WAN is the only internet connection for the building. I did start it, mine only shows me the last capture not stop and start. Yes, I did start it, then and again now with the new settings. I'm on 2.4.4_2. I've confirmed my IP via IPCHICKEN and asked google "what is my IP" and both of those match the one I'm using and see in pfsense for the WAN side.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @combat_wombat27
                          last edited by

                          @combat_wombat27 said in Just trying to forward 443 to an internal server:

                          both of those match the one I'm using and see in pfsense for the WAN side.

                          Huh - look in your state table for the source IP that is talking to your 192.168.1.4 -- filter on that..

                          You really should update 2.4 has been eol for awhile.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.