Can't reach internal web server

rvoosterhout · Sep 14, 2016, 7:46 PM

Hi everybody

First of all, thanks for trying to help me out. I'm a real beginner using pfsense, and any help is much appreciated.
In my home network, i have a web-server, which runs a small website. I have been using a Dell sonicwall before, but i changed to pfsense to get a new challenge.
I believe i have successfully created a NAT rule to forward any traffic asking on port 80 to my web-server. Unfortunately i can't reach it. I have a simple home setup, where pfsense is my gateway. I can reach my pfsense box on my external ip using a special set port number.

Can you guys check what i did wrong? I added some attachments of my rules.

Thanks a lot in advance!

![NAT 2.jpg](/public/imported_attachments/1/NAT 2.jpg)
![NAT 2.jpg_thumb](/public/imported_attachments/1/NAT 2.jpg_thumb)
![Firewall rules.jpg](/public/imported_attachments/1/Firewall rules.jpg)
![Firewall rules.jpg_thumb](/public/imported_attachments/1/Firewall rules.jpg_thumb)

KOM · Sep 14, 2016, 8:32 PM

https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks

Protip: Split DNS

rvoosterhout · Sep 14, 2016, 8:58 PM

I applied your suggestion, but i still can't reach my webpage.

KOM · Sep 15, 2016, 12:47 PM

Disable NAT Reflection mode since you're not using NAT Reflection. When you do a lookup on your domain, does the override work and give you the local IP address?

rvoosterhout · Sep 16, 2016, 7:56 AM

Yesss, now i dissabled NAT reflection and i can reach my website, from inside and outside. Thanks a lot!!!

rvoosterhout · Sep 24, 2016, 3:53 PM

Hey, i still have a problem when reaching my web server. I had to re-install my pfsensebox, and did exactly the same settings as before. But now when i go to my webpage, i reach the pfsensebox warning me for a potential DNS Rebind attack. It doesn't redirect me to my web server anymore. The URL also changes to a HTTPS page, using my pfsense port, not using port 80 and http to reach the website.

![DNS redirect.JPG](/public/imported_attachments/1/DNS redirect.JPG)
![DNS redirect.JPG_thumb](/public/imported_attachments/1/DNS redirect.JPG_thumb)

rvoosterhout · Sep 25, 2016, 3:04 PM

I don't get the DNS rebind attack message anymore, and my website is accesible from inside my network. I can't reach the website from outside my network (using 4g on my phone)

NOYB · Sep 26, 2016, 2:36 AM

@rvoosterhout:

Hey, i still have a problem when reaching my web server. I had to re-install my pfsensebox, and did exactly the same settings as before. But now when i go to my webpage, i reach the pfsensebox warning me for a potential DNS Rebind attack. It doesn't redirect me to my web server anymore. The URL also changes to a HTTPS page, using my pfsense port, not using port 80 and http to reach the website.

Most likely due to HSTS. See this thread for more details and how to fix so that NAT reflection works. Clear browser cookies remove the pfSense HSTS cookie.
[SOLVED] NAT Reflection Troubles
https://forum.pfsense.org/index.php?topic=98764.0

rvoosterhout · Sep 26, 2016, 2:57 PM

@NOYB:

@rvoosterhout:

Hey, i still have a problem when reaching my web server. I had to re-install my pfsensebox, and did exactly the same settings as before. But now when i go to my webpage, i reach the pfsensebox warning me for a potential DNS Rebind attack. It doesn't redirect me to my web server anymore. The URL also changes to a HTTPS page, using my pfsense port, not using port 80 and http to reach the website.

Most likely due to HSTS. See this thread for more details and how to fix so that NAT reflection works. Clear browser cookies remove the pfSense HSTS cookie.
[SOLVED] NAT Reflection Troubles
https://forum.pfsense.org/index.php?topic=98764.0

Thanks for your reply, but i don't have the DNS rebind warning anymore. My website is reachable from inside my local network, because of the DNS resolver host override rule but not from outside my network. And I would like my website to be accessible from outside my local network, so that i don't need to use splitdns. This way I'm always sure my website is reachable.

KOM · Sep 26, 2016, 4:50 PM

Then you've probably borked your NAT rule or firewall rule. NAT rule defines the access, firewall rule allows it. Both need to work or your port-forward won't work.

rvoosterhout · Sep 26, 2016, 4:56 PM

@KOM:

Then you've probably borked your NAT rule or firewall rule. NAT rule defines the access, firewall rule allows it. Both need to work or your port-forward won't work.

Thanks for your reply. I recreated the rules multiple times, but unfortunately with no result. My setup right now is exactly as the picture's in post #1 and #3

viragomann · Sep 26, 2016, 5:17 PM

In the NAT rule the destination has to be the WAN address not the Webserver.

rvoosterhout · Sep 26, 2016, 5:19 PM

@viragomann:

In the NAT rule the destination has to be the WAN address not the Webserver.

Can you explain why is that? I don't understand. I want my webserver to be reachable from the internet, so then the destination is my internal webserver and the source is 'any' right?

EDIT: After changing it to WAN NET, the website is reachable. I don't understand why though.

johnpoz · Sep 26, 2016, 5:25 PM

Why would you change it to WAN net? You mean you changed it to WAN address.

I want to go to your webserver from the public internet. So what would be the dest of the nat? It would be your public IP ie your wan address, which would then forward to your webserver IP.

The firewall rule is what would allow the traffic to your webserver via the nat rule.

rvoosterhout · Sep 26, 2016, 5:33 PM

@johnpoz:

Why would you change it to WAN net? You mean you changed it to WAN address.

I want to go to your webserver from the public internet. So what would be the dest of the nat? It would be your public IP ie your wan address, which would then forward to your webserver IP.

The firewall rule is what would allow the traffic to your webserver via the nat rule.

Any of them, WAN net and Adress, they both seem to work, what's the difference?

So correct me if i'm wrong. A person is trying to reach my web page. My URL is directed to my Public WAN IP address. My firewall picks up this request and sends it to the corresponding NAT rule. In the NAT rule I defined that any person, trying to access my public IP (WAN address) on port 80 should be forwarded to my local server IP. Then PFsense forwards this request to my server, which in respond of that shows a web page.

Is that what's happening here?

Thanks for all your help. I'm a beginner in networking, but very eager to learn more! :)

johnpoz · Sep 26, 2016, 5:37 PM

" My URL is directed to my Public WAN IP address. My firewall picks up this request and sends it to the corresponding NAT rule. In the NAT rule I defined that any person, trying to access my public IP (WAN address) on port 80 should be forwarded to my local server IP. Then PFsense forwards this request to my server"

Exactly other than that forward has to run through the firewall rules to see if allowed, which is the firewall rule that is auto created by the port forward you create.

You don't understand the difference between wan address and wan network?

Wan address would be the specific IP of your wan interface. Say 1.2.3.4/24 while network would be anything in that network ie 1.2.3.0/24 Why would some going to say 1.2.3.15 hit your actual interface on your wan??

rvoosterhout · Sep 26, 2016, 5:44 PM

@johnpoz:

Wan address would be the specific IP of your wan interface. Say 1.2.3.4/24 while network would be anything in that network ie 1.2.3.0/24 Why would some going to say 1.2.3.15 hit your actual interface on your wan??

Ahh i understand. People are navigating to my WAN address, not a entire WAN network. And that's why WAN net would still work because it's still within the range of my WAN address right? So it's a matter of safety to select WAN address?

NOYB · Sep 26, 2016, 5:53 PM

@rvoosterhout:

Thanks for all your help. I'm a beginner in networking, but very eager to learn more! :)

Wikipedia has lots of good information on networking subjects. Here is on for NAT.

Network address translation
https://en.wikipedia.org/wiki/Network_address_translation

johnpoz · Sep 26, 2016, 5:55 PM

Not really matter of safety, matter of what is actually correct in the case of your port forward they sure are not going to be going to anything other than your wan address. Wan net is there just like all the other interface net rules because you might use them in some other sort of rule. But in a port forward no wan net would not be correct setup.

KOM · Sep 26, 2016, 6:05 PM

WAN net and Adress, they both seem to work, what's the difference?

If you only have the one public IP address then they're essentially the same. The difference becomes apparent when you have an IP range. For example, if your ISP gave you a /28 so you have 13 usable IP addresses, then WAN Net is any of those IP addresses that make up your WAN network, while WAN address is the specific IP address used by your WAN.