Can't reach internal web server
-
Then you've probably borked your NAT rule or firewall rule. NAT rule defines the access, firewall rule allows it. Both need to work or your port-forward won't work.
-
@KOM:
Then you've probably borked your NAT rule or firewall rule. NAT rule defines the access, firewall rule allows it. Both need to work or your port-forward won't work.
Thanks for your reply. I recreated the rules multiple times, but unfortunately with no result. My setup right now is exactly as the picture's in post #1 and #3
-
In the NAT rule the destination has to be the WAN address not the Webserver.
-
In the NAT rule the destination has to be the WAN address not the Webserver.
Can you explain why is that? I don't understand. I want my webserver to be reachable from the internet, so then the destination is my internal webserver and the source is 'any' right?
EDIT: After changing it to WAN NET, the website is reachable. I don't understand why though.
-
Why would you change it to WAN net? You mean you changed it to WAN address.
I want to go to your webserver from the public internet. So what would be the dest of the nat? It would be your public IP ie your wan address, which would then forward to your webserver IP.
The firewall rule is what would allow the traffic to your webserver via the nat rule.
-
Why would you change it to WAN net? You mean you changed it to WAN address.
I want to go to your webserver from the public internet. So what would be the dest of the nat? It would be your public IP ie your wan address, which would then forward to your webserver IP.
The firewall rule is what would allow the traffic to your webserver via the nat rule.
Any of them, WAN net and Adress, they both seem to work, what's the difference?
So correct me if i'm wrong. A person is trying to reach my web page. My URL is directed to my Public WAN IP address. My firewall picks up this request and sends it to the corresponding NAT rule. In the NAT rule I defined that any person, trying to access my public IP (WAN address) on port 80 should be forwarded to my local server IP. Then PFsense forwards this request to my server, which in respond of that shows a web page.
Is that what's happening here?
Thanks for all your help. I'm a beginner in networking, but very eager to learn more! :)
-
" My URL is directed to my Public WAN IP address. My firewall picks up this request and sends it to the corresponding NAT rule. In the NAT rule I defined that any person, trying to access my public IP (WAN address) on port 80 should be forwarded to my local server IP. Then PFsense forwards this request to my server"
Exactly other than that forward has to run through the firewall rules to see if allowed, which is the firewall rule that is auto created by the port forward you create.
You don't understand the difference between wan address and wan network?
Wan address would be the specific IP of your wan interface. Say 1.2.3.4/24 while network would be anything in that network ie 1.2.3.0/24 Why would some going to say 1.2.3.15 hit your actual interface on your wan??
-
Wan address would be the specific IP of your wan interface. Say 1.2.3.4/24 while network would be anything in that network ie 1.2.3.0/24 Why would some going to say 1.2.3.15 hit your actual interface on your wan??
Ahh i understand. People are navigating to my WAN address, not a entire WAN network. And that's why WAN net would still work because it's still within the range of my WAN address right? So it's a matter of safety to select WAN address?
-
Thanks for all your help. I'm a beginner in networking, but very eager to learn more! :)
Wikipedia has lots of good information on networking subjects. Here is on for NAT.
Network address translation
https://en.wikipedia.org/wiki/Network_address_translation -
Not really matter of safety, matter of what is actually correct in the case of your port forward they sure are not going to be going to anything other than your wan address. Wan net is there just like all the other interface net rules because you might use them in some other sort of rule. But in a port forward no wan net would not be correct setup.
-
WAN net and Adress, they both seem to work, what's the difference?
If you only have the one public IP address then they're essentially the same. The difference becomes apparent when you have an IP range. For example, if your ISP gave you a /28 so you have 13 usable IP addresses, then WAN Net is any of those IP addresses that make up your WAN network, while WAN address is the specific IP address used by your WAN.
-
^ very true!! But highly unlikely you would want all your IPs on your wan sent to the same place ;) So in that case you would prob use the dest of your specific vip you setup in that /28 network, etc.
