unable to access webserver with static ip and port from pfsense only
-
@viragomann yes exactly! any home router.
-
@Samuelking
Can you access any other resource in the internet?
Can you ping 1.1.1.1 or 8.8.8.8? -
@viragomann yes i can ping, access websites
-
@Samuelking
So DNS and Outbound NAT might work properly.
But by default, pfSense doesn't restrict any outbound connection on LAN interface. Did you mess the LAN rules?What exactly do you get, when trying to access the website?
Did you try with different browsers? -
-
@viragomann even if delete all rules and make default same issue
yes tried chrome and edge both -
@Samuelking
Without showing the rule action on the left, the rules screenshot is pretty useless.
Presumed the last rule is a block rule, because you created pass rules for certain services, access to port 846 would not be allowed by your rule set. -
Yeah without seeing what those are allow/deny they are not all that helpful..
That 2nd rule to pfb_pri would assume is a block, and that for sure could be blocking access, it has been evaluated some.
And as @viragomann mentions that last rule also assuming its a block would not allow access to some port 846 because it doesn't seem like you allow that port above it.
When you post rules, you should include the top part showing what actual interface of pfsense its on.. And we need to see if the rules are allow, deny, reject, etc. Yeah we would assume this is on the lan.. But then the any any rules make no sense unless this is a transit network.. How would you have any source IPs coming into lan that were not lan net? So rules with any as source don't make a lot of sense.
Also do you have any floating rules?
-
@viragomann @johnpoz all rules are allowed except dns 2nd rule and pfblockerng which is reject, also i have tried to clear all rules to default but same issue
no floating rules
I changed to bydefault rules prior to this configuration
this is my home network now i am away my network..please suggest basic standard rules so that i can access webserver from pfsense
-
@Samuelking so your saying with the default any any rule and no other rules, and no rules in floating.. You can not access some public IP on port 846.. Could you pm me this IP and I can check.
I would sniff on your wan when you try and make the connection - do you see the traffic leaving pfsense - is there any response, maybe it is sending back RST, or maybe its just not answering to your IP.
Do you show a state being created in the state table? Are you using a vpn connection?
-
@johnpoz no state table no vpn conf
-
@Samuelking said in unable to access webserver with static ip and port from pfsense only:
please suggest basic standard rules so that i can access webserver from pfsense
I just use any any.. I have no need to limit what my pc can go to ;) My other segments have limiting rules, etc.
-
@Samuelking said in unable to access webserver with static ip and port from pfsense only:
no state table
Well if there is not state for you trying to go to 1.2.3.4:846 then no you wouldn't ever be able to get there.. Is your client even going through pfsense.. If so there would be a state.. Unless a firewall rule is blocking it.
Your not using an overlapping IP address on your lan are you - have seen crazier things.. Users thinking they can just pull some rando public IP space out of thin air and use it on the local network.. And then can not figure out why they cant get to the public IP range out on the internet ;)
A state would be created for any traffic that is allowed by the rules - even if nothing answers - example just attempted to create a connection to 1.2.3.4:846 you can see the states created.
-
@johnpoz @viragomann thanks for replies, now i changed the rules to default but still can't access the webserver with ip i dont know what is going wrong......
-
@Samuelking
What exactly do you get in the browser, when trying to access the website.Did you sniff the traffic on WAN while trying that as @johnpoz suggested?
It's quite easy. Diagnostic > Packet Capture. Select WAN interface, enter the specific port used into the port filter box and start the capture. Then try to access the website and check if you can see the packets. -
@viragomann no packets are captured when trying to access this webserver
-
That's your answer : no traffic, with destination = your web server, reached your WAN interface.
You can stop looking if the issue is related to a pfSense settings as the issue is upstream.Is your WAN IP a RFC1918 or not ?
Same question : is your upstream device an ISP router ? -
@Gertjan said in unable to access webserver with static ip and port from pfsense only:
yes upstream device an ISP router but it is in bridged mode
issue is only with pfsense when i replace it with tplink router i can access easily -
@Samuelking
As there are no relating packets on WAN, sniff on LAN with filtering to the destination port only, to get sure, that the packets even are routed to pfSense.Possibly your testing device uses not pfSense as upstream gateway.
-
Normally, packet capturing isn't even needed.
Here are my WAN firewall rules, some of them are part of a NAT rule :
For example (the line marked green), is not a web server (port 80 or 443) but a SSH server on port 22, my diskstation ( = alias diskstation2), living on my LAN, IP 192.168.1.32.
You see the counters marked green ? That means traffic was handled by that rule, which means matching traffic, send to my diskstation2 device, entered the WAN interface.
Is your WAN IP a RFC1918 or not ?
