Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Installed 2.3.2-RELEASE and I can't open websites unless I put https in front

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    11 Posts 4 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      MrRoute
      last edited by

      hi, I just installed the latest version into an esxi machine. everything is working well, except when I try to open a website it will give me a "This site can't be reached" error, but if I place https in front, it'll work. The big issue, is for sites that don't have https, I can't open them at all! I haven't installed a single package, so squid or anything like it isn't an issue.

      Is there a settings I'm missing that either will allow redirects or do I need to edit something to allow me to access websites that are only being hosted on port 80?

      Please help!

      Thanks,

      1 Reply Last reply Reply Quote 0
      • H
        heper
        last edited by

        never heard of a default install that exhibits that behaviour. don't know of any setting that could change that.

        only thing i can think of is that you create a rule to block http

        1 Reply Last reply Reply Quote 0
        • M
          MrRoute
          last edited by

          I understand the "weirdness" but it's an installation from scratch.. I haven't even created rules.. I'll try to reinstall it again, just in case. I'll post back with an update

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            The default configuration simply will not behave that way. You have something else in your environment doing it.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • M
              MrRoute
              last edited by

              I can understand that. I've installed pfsense countless of times and have never run into something like this. I just reinstalled a new pfsense from scratch and it's still doing the same thing. I'm comparing it to another fully working pfsense that I have, which has just about the same identical configurations, the only difference, at the top right corner I see the ipv4 address and an ipv6 address, but the one that is having the issue doesn't have ipv6 associated.

              Also, in the pfsesne that is having the issue, under diganostics > states I see  "WAN ipv6-icmp fe80::201:…...[902\ -> ff02::1[192] NO_TRAFFIC:NO_TRAFFIC 105/0  19KiB/0B

              I'm not sure if I'm on to something but does ipv6 have something to do with this..? I can't pull up espn.com and if I go to www.corelifenutrition.com, it doesn't work but if I go to https://www.corelifenutrition.com, it does. This is about the same with anything, if https is not present, it can't open.

              My current setup, I have pfsense running in vmware, I have two nics in the server. One that is connected directly to the modem and the other nic is connected to a switch. In pfsense, under the WAN interface, I've placed the mac address of the servers nic that is connected directly to the modem. Which as I said, is working, but is having that https issue. I have not added packages or any rules of any kind and it's a fresh install…..

              1 Reply Last reply Reply Quote 0
              • N
                NOYB
                last edited by

                Since this is so bizarre I'm going to just throw out a couple of things to see if anything sticks to the wall.

                1. Is this a mixed architecture install?  i.e. 32 bit on 64 bit hardware/VM or vise versa?

                2. Try a cURL command for http to see if the router itself is able to get the web page.

                3. By this time surely you've cleared browser cache and cookies.

                1 Reply Last reply Reply Quote 0
                • N
                  NOYB
                  last edited by

                  1. Get HttpWatch, or use browsers built-in tools to see if it reveals anything about requests and responses.
                  1 Reply Last reply Reply Quote 0
                  • N
                    NOYB
                    last edited by

                    1. Check gateways/routing etc. to make sure request are going through router/NAT.
                    1 Reply Last reply Reply Quote 0
                    • M
                      MrRoute
                      last edited by

                      I'm checking all those right now. But as a quick update I ran wireshark and this is what I'm seeing..

                      For Connections on port 80 (highlighted in red in wireshark):

                      3559 30.083953 173-254-52-235.unifiedlayer.com 10.20.0.222 TCP 60 80→49705 [RST] Seq=1 Win=0 Len=0

                      But when it's on port 443 (not highlighted in wireshark):

                      3373 28.806268 173-254-52-235.unifiedlayer.com 10.20.0.222 TLSv1.2 85 Encrypted Alert

                      I'm starting to think it may be that I'm spooking the mac address of the physical server's nic into pfsense and port 80 is somehow blocking the port from coming in. Or at least that's what I'm understanding from [RST] and adding the mac address into the WAN configuration page…

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        I have no idea why you're mucking about with MAC address spoofing but it shouldn't make any difference what port is in play. Screwed up layer 2 is pretty much an equal opportunity misconfiguration.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • M
                          MrRoute
                          last edited by

                          I figured it out, my vmware networking was all messed up. I had to rebuild the esxi server and that resolved the issue. Thanks for the multiple ideas and all the assistance, greatly appreciated!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.