Cannot access web server through pfsense firewall
-
Hi
I have a web server located at 10.0.X.X and I have added a public IP as a virtual IP alias to my WAN interface on pfSense.
If I navigate to http://10.0.X.X within the network the web server loads fine - I also have a second public IP added directly on the web server via a separate network card and this also works fine - but if I use the virtual IP on pfSense it just hangs - on Google Chrome eventually the 'This site can’t be reached' page is shown.
This happens when the software firewall running on the web server (iptables) is switched on or off.
From within pfSense I can ping 10.0.X.X fine. If I run ifconfig on pfSense the public IP does appear on the WAN interface.
I have set up NAT, Port Forwarding and Firewall rules - pure reflection turned on throughout.
When I access the public IP in my browser it shows up as a successful pass in the firewall logs (I tried this on my 3G mobile connection too and the same happens so the IP is definitely working).
There has to be something I need to do on pfSense to get this to work - probably something simple but I can't figure it out!
Ashley
-
Putting up some screenshots of what I have set up:
-
https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks
Try a different NAT Reflection mode, or setup split DNS so that your sites resolve to their internal IP addresses.
-
I have tried both pure and proxied NAT reflection. It does not work.
I don't really want to go down the Split DNS route - can you give possible reasons why the method I am using isn't working?
I can't access my forwarded ports anywhere, I can't access them on any internet connection, not just from within the network.
-
"I don't really want to go down the Split DNS route"
Can you give an actual valid reason why you would not want to use the better solution to accessing resources that are actually local?? And instead prefer the abomination that is nat reflection ;)
-
Just setup a couple of host overrides to redirect to local in whatever DNS you're using. It's really not hard at all for the vats majority of cases.
