Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't reach internal web server

    Scheduled Pinned Locked Moved NAT
    21 Posts 5 Posters 8.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rvoosterhout
      last edited by

      I don't get the DNS rebind attack message anymore, and my website is accesible from inside my network. I can't reach the website from outside my network (using 4g on my phone)

      1 Reply Last reply Reply Quote 0
      • N
        NOYB
        last edited by

        @rvoosterhout:

        Hey, i still have a problem when reaching my web server. I had to re-install my pfsensebox, and did exactly the same settings as before. But now when i go to my webpage, i reach the pfsensebox warning me for a potential DNS Rebind attack. It doesn't redirect me to my web server anymore. The URL also changes to a HTTPS page, using my pfsense port, not using port 80 and http to reach the website.

        Most likely due to HSTS.  See this thread for more details and how to fix so that NAT reflection works.  Clear browser cookies remove the pfSense HSTS cookie.
        [SOLVED] NAT Reflection Troubles
        https://forum.pfsense.org/index.php?topic=98764.0

        1 Reply Last reply Reply Quote 0
        • R
          rvoosterhout
          last edited by

          @NOYB:

          @rvoosterhout:

          Hey, i still have a problem when reaching my web server. I had to re-install my pfsensebox, and did exactly the same settings as before. But now when i go to my webpage, i reach the pfsensebox warning me for a potential DNS Rebind attack. It doesn't redirect me to my web server anymore. The URL also changes to a HTTPS page, using my pfsense port, not using port 80 and http to reach the website.

          Most likely due to HSTS.  See this thread for more details and how to fix so that NAT reflection works.  Clear browser cookies remove the pfSense HSTS cookie.
          [SOLVED] NAT Reflection Troubles
          https://forum.pfsense.org/index.php?topic=98764.0

          Thanks for your reply, but i don't have the DNS rebind warning anymore. My website is reachable from inside my local network, because of the DNS resolver host override rule  but not from outside my network. And I would like my website to be accessible from outside my local network, so that i don't need to use splitdns. This way I'm always sure my website is reachable.

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            Then you've probably borked your NAT rule or firewall rule.  NAT rule defines the access, firewall rule allows it.  Both need to work or your port-forward won't work.

            1 Reply Last reply Reply Quote 0
            • R
              rvoosterhout
              last edited by

              @KOM:

              Then you've probably borked your NAT rule or firewall rule.  NAT rule defines the access, firewall rule allows it.  Both need to work or your port-forward won't work.

              Thanks for your reply. I recreated the rules multiple times, but unfortunately with no result. My setup right now is exactly as the picture's in post #1 and #3

              1 Reply Last reply Reply Quote 0
              • V
                viragomann
                last edited by

                In the NAT rule the destination has to be the WAN address not the Webserver.

                1 Reply Last reply Reply Quote 0
                • R
                  rvoosterhout
                  last edited by

                  @viragomann:

                  In the NAT rule the destination has to be the WAN address not the Webserver.

                  Can you explain why is that? I don't understand. I want my webserver to be reachable from the internet, so then the destination is my internal webserver and the source is 'any' right?

                  EDIT: After changing it to WAN NET, the website is reachable. I don't understand why though.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Why would you change it to WAN net?  You mean you changed it to WAN address.

                    I want to go to your webserver from the public internet.  So what would be the dest of the nat?  It would be your public IP ie your wan address, which would then forward to your webserver IP.

                    The firewall rule is what would allow the traffic to your webserver via the nat rule.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • R
                      rvoosterhout
                      last edited by

                      @johnpoz:

                      Why would you change it to WAN net?  You mean you changed it to WAN address.

                      I want to go to your webserver from the public internet.  So what would be the dest of the nat?  It would be your public IP ie your wan address, which would then forward to your webserver IP.

                      The firewall rule is what would allow the traffic to your webserver via the nat rule.

                      Any of them, WAN net and Adress, they both seem to work, what's the difference?

                      So correct me if i'm wrong. A person is trying to reach my web page. My URL is directed to my Public WAN IP address. My firewall picks up this request and sends it to the corresponding NAT rule. In the NAT rule I defined that any person, trying to access my public IP (WAN address) on port 80 should be forwarded to my local server IP. Then PFsense forwards this request to my server, which in respond of that shows a web page.

                      Is that what's happening here?

                      Thanks for all your help. I'm a beginner in networking, but very eager to learn more!  :)

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        " My URL is directed to my Public WAN IP address. My firewall picks up this request and sends it to the corresponding NAT rule. In the NAT rule I defined that any person, trying to access my public IP (WAN address) on port 80 should be forwarded to my local server IP. Then PFsense forwards this request to my server"

                        Exactly other than that forward has to run through the firewall rules to see if allowed, which is the firewall rule that is auto created by the port forward you create.

                        You don't understand the difference between wan address and wan network?

                        Wan address would be the specific IP of your wan interface.  Say 1.2.3.4/24 while network would be anything in that network ie 1.2.3.0/24  Why would some going to say 1.2.3.15 hit your actual interface on your wan??

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • R
                          rvoosterhout
                          last edited by

                          @johnpoz:

                          Wan address would be the specific IP of your wan interface.  Say 1.2.3.4/24 while network would be anything in that network ie 1.2.3.0/24  Why would some going to say 1.2.3.15 hit your actual interface on your wan??

                          Ahh i understand. People are navigating to my WAN address, not a entire WAN network. And that's why WAN net would still work because it's still within the range of my WAN address right? So it's a matter of safety to select WAN address?

                          1 Reply Last reply Reply Quote 0
                          • N
                            NOYB
                            last edited by

                            @rvoosterhout:

                            Thanks for all your help. I'm a beginner in networking, but very eager to learn more!  :)

                            Wikipedia has lots of good information on networking subjects.  Here is on for NAT.

                            Network address translation
                            https://en.wikipedia.org/wiki/Network_address_translation

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Not really matter of safety, matter of what is actually correct in the case of your port forward they sure are not going to be going to anything other than your wan address.  Wan net is there just like all the other interface net rules because you might use them in some other sort of rule.  But in a port forward no wan net would not be correct setup.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • KOMK
                                KOM
                                last edited by

                                WAN net and Adress, they both seem to work, what's the difference?

                                If you only have the one public IP address then they're essentially the same.  The difference becomes apparent when you have an IP range.  For example, if your ISP gave you a /28 so you have 13 usable IP addresses, then WAN Net is any of those IP addresses that make up your WAN network, while WAN address is the specific IP address used by your WAN.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  ^ very true!!  But highly unlikely you would want all your IPs on your wan sent to the same place ;)  So in that case you would prob use the dest of your specific vip you setup in that /28 network, etc.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.