Problem with Browsing my website

wallabybob

Thanks for the additional information. There is nothing there that I think explains what you are seeing.

Does the web server on the orange network log access attempts? Do the access attempts appear there?

Have you used packet capture on the web server to verify the access attempts arrive there and appropriate response is generated?

stephenw10

This looks bad:

re2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
options=389b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic>ether 00:14:d1:1a:53:c7
inet 192.168.1.101 netmask 0xfffffc00 broadcast 192.168.3.255
inet6 fe80::214:d1ff:fe1a:53c7%re2 prefixlen 64 scopeid 0x3
nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
status: active</full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic></up,broadcast,running,simplex,multicast>

Also I see you have removed the 'default LAN to any' rule. Any reason you did that?

Steve

wallabybob

@stephenw10:

This looks bad:

re2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
options=389b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic>ether 00:14:d1:1a:53:c7
inet 192.168.1.101 netmask 0xfffffc00 broadcast 192.168.3.255
inet6 fe80::214:d1ff:fe1a:53c7%re2 prefixlen 64 scopeid 0x3
nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
status: active</full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic></up,broadcast,running,simplex,multicast>

Why do you say it looks bad? The network has been referred to as 192.168.1.x which suggests it might have been meant to have a netmask of 24 bits rather than 22.

@stephenw10:

Also I see you have removed the 'default LAN to any' rule. Any reason you did that?

Good question, but the posted rule set should allow web access from LAN to 10.0.0.2.

stephenw10

You're right in both cases. I didn't think through that subnet.
These things together though seem to indicate this box may be quite far from default. Assume nothing! ;)

Steve

wallabybob

@stephenw10:

These things together though seem to indicate this box may be quite far from default. Assume nothing! ;)

Agreed. I have been suspicious of "I didn't change anything" since dealing with someone complaining two program runs with the some data gave different results. How could this be? Some digging around turned up the "insignificant" fact that the data was on punched cards (who remembers them?) and the deck of cards had been dropped on the floor. "same data" sure - but "randomised".

hossam.khalili

thanks for everyone,
but i didn't get the answer for my Question, what should i do now!!

please help.

thanks.

stephenw10

You could answer the various questions above. ;)

This should work without any special configuration. There are (at least) two reasons why it might not work:
1. The firewall is blocking the connection. This should be allowed by the pfSense by default. It looks like it should work with your existing rules too. However I see you have removed the 'default LAN to any' firewall rule. Why have you done that?

2. There is some routing problem preventing traffic either reaching the server or replies from reaching you. Again this should work by default. We spotted that your LAN appears to be a /22 subnet, is that deliberate or a config error?

Have you changed anything else in the box, like added manual routes or gateways?

Steve

hossam.khalili

thanks Steve for reply,
Actually, "Default LAN to any" is a rule i made it, then i removed it and create what I attached on the last image.

but i agree with the second reason, how can i fix "Routing problem preventing traffic"?, cause if i change my IP to 192.168.3.x/24 i can access the website.

Thanks Again.
:)

stephenw10

Ah, then I suggest you have a subnet mismatch somewhere.
Do you mean if you change the IP on your client to a static 192.168.3.X/24?

Did you intend to have the /22 subnet on the pfSense LAN interface?

Steve

hossam.khalili

Steve thanks for reply,
yes, if i change any client to 192.168.3.x/24 the website browsing

no problem, regardless of subnet if changing the subnet will fix the problem, show me how can i do it
thanks.