• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

NAT (Port Forwarding) and web failover

Scheduled Pinned Locked Moved NAT
27 Posts 4 Posters 9.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M Offline
    marcelloc
    last edited by Feb 27, 2012, 3:15 PM

    Did you changed pfsense gui port and disabled WebGUI redirect to avoid conflict with your http redirect?

    Is 192.168.100.100 your wan address?

    Treinamentos de Elite: http://sys-squad.com

    Help a community developer! ;D

    1 Reply Last reply Reply Quote 0
    • P Offline
      podilarius
      last edited by Feb 27, 2012, 3:18 PM

      In your network, is the site-to-site a VPN or a point to point connection? They seem to be in different networks, so you are going to have to make sure that your routing and NAT reflect this.

      1 Reply Last reply Reply Quote 0
      • S Offline
        skipper
        last edited by Feb 27, 2012, 3:27 PM

        i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
        how do i disable WebGUI redirection?
        192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

        1 Reply Last reply Reply Quote 0
        • S Offline
          skipper
          last edited by Feb 27, 2012, 3:30 PM

          it's a vpn site-to-site. there is routing between the 2 networks so the web and web-slave can see each other. do i need an additional routing rule?

          1 Reply Last reply Reply Quote 0
          • M Offline
            marcelloc
            last edited by Feb 27, 2012, 4:42 PM

            @skipper:

            i am accessing pfsense via http and the virtual server is listening to https so i think no conflict there (System: Advanced: Admin Access, protocol http).
            how do i disable WebGUI redirection?
            192.168.100.100 this is virtual's server ip, my wan address has an internet ip.

            Create another virtual server with wan ip and it will work.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • S Offline
              skipper
              last edited by Feb 27, 2012, 9:54 PM

              hey marcelloc thnx a lot, it's working!!
              i cannot access the web-slave from internet but i can access it from web's network.
              do i have to create some nat or routing about that?

              1 Reply Last reply Reply Quote 0
              • M Offline
                marcelloc
                last edited by Feb 27, 2012, 10:39 PM

                What status you have on loadbalance for the web-slave?

                status -> loadbalancer

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • S Offline
                  skipper
                  last edited by Feb 27, 2012, 10:50 PM

                  the status is enable and accessible (green 100%) that's why i don't understand.

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    skipper
                    last edited by Feb 28, 2012, 3:30 PM

                    i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

                    1 Reply Last reply Reply Quote 0
                    • M Offline
                      marcelloc
                      last edited by Feb 28, 2012, 3:39 PM

                      @skipper:

                      i found out that when an https request is going to web-slave through the vpn, then the web-slave is trying to send the package through the wan interface and not back to vpn. can i somehow force this traffic to pass through the vpn connection?

                      You will need an outbound nat to "masquerade" client internet ip. This way the server can return the package through vpn instead of forwarding it to it's wan

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        skipper
                        last edited by Feb 28, 2012, 3:49 PM

                        thnx for your help marcelloc!!
                        how must the outbound nat look?
                        these are the vpn IPs
                        pfsense1 ip : 10.4.0.1
                        pfsense2 ip : 10.4.0.2

                        1 Reply Last reply Reply Quote 0
                        • M Offline
                          marcelloc
                          last edited by Feb 28, 2012, 4:26 PM

                          It's on firewall -> nat -> outbound

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            skipper
                            last edited by Feb 28, 2012, 4:40 PM

                            i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
                            here is my outbound nat rule

                            Interface webslavelan
                            Source      192.168.129.0/24
                            Source Port   443
                            Destination   10.4.0.0/30
                            Destination Port *
                            NAT Address *
                            NAT Port   443
                            Static Port   NO

                            1 Reply Last reply Reply Quote 0
                            • M Offline
                              marcelloc
                              last edited by Feb 28, 2012, 4:46 PM

                              @skipper:

                              i created an outbound nat but the traffic is still going to the wan interface and not back to vpn
                              here is my outbound nat rule

                              Interface webslavelan
                              Source       192.168.129.0/24
                              Source Port    443
                              Destination    10.4.0.0/30
                              Destination Port *
                              NAT Address *
                              NAT Port    443
                              Static Port    NO

                              change source to any.
                              does webslavelan is the outgoing interface to reach 10.4.0.0/30?

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                skipper
                                last edited by Feb 28, 2012, 7:35 PM Feb 28, 2012, 7:33 PM

                                thnx for your help man!
                                this is my network a bit more detailed,
                                i have tried to put different interfaces and IPs on the outbound configuration but the traffic goes still to my wan :/
                                now i put vpnsitetosite as interface and source any but it doesn't work.
                                what should the destination be? is there something else that i need to define? create a new gateway or something like that?

                                net.jpg
                                net.jpg_thumb

                                1 Reply Last reply Reply Quote 0
                                • M Offline
                                  marcelloc
                                  last edited by Feb 28, 2012, 9:03 PM

                                  Try to go to console and do some package capture to find what interface pfsense is using to send traffic to remote host.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • S Offline
                                    skipper
                                    last edited by Feb 28, 2012, 9:16 PM

                                    the request is going from vpnsitetosite–>webslavelan-->webslave
                                    and the reply is going from webslave-->webslavelan-->wan
                                    i need to send it back to vpnsitetosite interface

                                    1 Reply Last reply Reply Quote 0
                                    • M Offline
                                      marcelloc
                                      last edited by Feb 28, 2012, 9:17 PM

                                      Can you select vpn interface on outgoing nat rule?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • S Offline
                                        skipper
                                        last edited by Feb 29, 2012, 12:00 PM Feb 28, 2012, 9:19 PM

                                        i can select OpenVPN but not the specific vpn interface.
                                        do i need to create a virtual IP, a rule to 1:1, or something additional?
                                        i have tried many combinations for the outbound rule but the http replies are keep going to the wan interface :/

                                        1 Reply Last reply Reply Quote 0
                                        • M Offline
                                          marcelloc
                                          last edited by Feb 29, 2012, 1:57 PM

                                          What you get when you select openvpn as interface on outbound nat for this server?

                                          If you can't do it with load balance, consider using a reverse proxy like (varnish,squid-reverse,apache+mod_security)

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          26 out of 27
                                          • First post
                                            26/27
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received