Port forwarding issue
-
Could you elaborate, please? What would this look like?
A NAT rule tells pfSense how to translation from public IP WAN request to private LAN host. In your case, you need a port forward so that pfSense know to forward certain traffic to the host on your LAN. To do a port forward, you need both a NAT rule to define the forwarding and a firewall rule to allow the traffic to flow. Sounds like you only have the firewall rule, if that.
https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting
-
@KOM:
Could you elaborate, please? What would this look like?
A NAT rule tells pfSense how to translation from public IP WAN request to private LAN host. In your case, you need a port forward so that pfSense know to forward certain traffic to the host on your LAN. To do a port forward, you need both a NAT rule to define the forwarding and a firewall rule to allow the traffic to flow. Sounds like you only have the firewall rule, if that.
https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense
https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting
Ok thanks.
That leaves two questions:
-
When setting up port forwarding, does it need to be done in tandem with reverse proxy (e.g. the squid reverse proxy which I have installed on the pfsense VM)
-
Do I need to make any changes to the domain name? I.E. the domain name is purchased with a registrar, do I need any records registered with them?
Thanks
-
-
When setting up port forwarding, does it need to be done in tandem with reverse proxy (e.g. the squid reverse proxy which I have installed on the pfsense VM)
I don't have any experience with squid reverse proxy so I can't advise you there, but I would tend to believe that if you have reverse proxy configured right, you shouldn't need a manual NAT rule? I don't know for sure.
Do I need to make any changes to the domain name? I.E. the domain name is purchased with a registrar, do I need any records registered with them?
The authoritative DNS for your domain should point back to your pfSense WAN IP address. Do you only have the one public IP address or more? If oyu have several public IPs and are using Virtual IPs to handle them, you would ensure that DNS for your domain points to the VIP you're using for that service.
-
@KOM:
I don't have any experience with squid reverse proxy so I can't advise you there, but I would tend to believe that if you have reverse proxy configured right, you shouldn't need a manual NAT rule? I don't know for sure.
You need allow rule on WAN for WAN IP/reverse proxy port. (N.B. This only can be meaningfully tested from WAN. Do NOT bother with "tests" from LAN via NAT reflection and similar clusterfucks.)
-
So you do need a firewall rule but not a NAT rule when using reverse proxy?
-
Yes. (Again, talking about valid tests from WAN.)
-
Ok so I've configured a DNS rule testsite.domain.com to go to my firewall's public IP address.
However, despite portforwarding setup, a firewall rule, and the reverse proxy, the web page is never hit?
I guess I should now ask in the Squid section.
-
so testsite.domain.com resolves on the public internet to your public IP??
-
However, despite portforwarding setup, a firewall rule, and the reverse proxy, the web page is never hit?
What port forwarding?! You either use RP or port-forwarding. Not both! And let me tell it again - testing this from LAN is a complete waste of time.
-
I tested from an outside machine but failed.
Nonetheless, I redid everything but no port forwarding rules and I can access an internal web server!
The only problem is I get the error here when changing the default port for the reverse proxy:
https://forum.pfsense.org/index.php?topic=87280.0
So my internal web server is running on port 8082. testsite.domain.com redirects to the pfsense homepage but testsite.domain.com:8082 goes to the web server.
Can I make testsite.domain.com go to testsite.domain.com without the port number showing?
