Https NAT not working

[khansen]

pfSense 2.3.2
webguiredirect is disabled
webconfigurator is set for https on port 8443

NAT is working for 80, openvpn and other ports but not for 443.
I moved webserver https port to 444 and created nat rule and it works fine, but when using 443 in a browser I get err_empty_response

Any ideas?

Thank you

[NOYB]

What response are you expecting to get?

From what you outlined it seems like maybe there is nothing listening on 443.

[khansen]

@khansen:

I moved webserver https port to 444 and created nat rule and it works fine, but when using 443 in a browser I get err_empty_response

Webserver was configured to listen on 443 and there should have been a comma between 443 and browser

[Derelict]

Then it would be working.

Even if the pfsense webgui was listening on 443 a port forward on WAN would take precedence.

Post what you have done.

[NOYB]

Ah, well that changes everything.  I was reading it as though you… well I think you know how I was reading it.

Maybe if you could show us the NAT rule would help.

[khansen]

created NAT rules and firewall rules were created automatically.

[Derelict]

That all looks fine. Not sure why your HTTPS rules are TCP/UDP instead of just TCP but that shouldn't hurt anything.

I conclude there is something on 192.168.1.6 that is misbehaving on port 443 and it's not pfSense.

Next step is probably Diagnostics > States, Diagnostics > Packet Capture, or logs from the server at 192.168.1.6.

[NOYB]

Is the web server currently configured to listen on 443 or 444?

Since when you disabled the web config redirect rule and changing port, have you rebooted pfSense?  If not it may be worth a try just for grins.

Probably a really long shot, but have you tried clearing browser cache?

[Derelict]

Completely unnecessary.

[NOYB]

@Derelict:

Completely unnecessary.

Supposed to be, yes I know that.  That's why I said just for grins.  Weird things do sometimes happen.

[Derelict]

Generally not.

[khansen]

Configured for 444 right now and no I did not reboot after changing the web redirect.

I will give this a try in a few.

@Derelict:

I conclude there is something on 192.168.1.6 that is misbehaving on port 443 and it's not pfSense.

Next step is probably Diagnostics > States, Diagnostics > Packet Capture, or logs from the server at 192.168.1.6.

Ok I will look at it again, I know there are a few other services that have their own webserver but I did not see them with netstat or lsof on port 443.

Thanks for the input though, I've been fighting this for a while.

[khansen]

And it was also a fresh apache2 install and it gave no errors when starting, just a little more info..

[NOYB]

If web server is configured to listen on 444 then the 443 rule is not going to work.

[Derelict]

You could port forward from 443 to 444 though.

Set the dest port to 443 and the NAT port to 444.

[khansen]

@Derelict:

You could port forward from 443 to 444 though.

Set the dest port to 443 and the NAT port to 444.

Tried this and 'site cant be reached'  'err_connection_timed_out'

[Derelict]

That will only work if your TLS web server is listening on 444. Only you know what's going on on your network/servers.

[khansen]

From local network

[Derelict]

Then I guess you need to figure out why connections from outside aren't completing. Packet capture on LAN port 444 and post.

[khansen]

Solved !!
Well not really but after 2 hours of tcpdump and no traffic ever reaching port 443, I decided to look at the trusty Uverse gateway for info I saw that it has port 443 used for the WAP if you have any wireless receivers, and then a quick little google turned up the the same from ATT.

After redoing the NAT on 444 to 444 the webserver does work.
Not an ideal solution, but its all I have now.

Thank you to everyone that responded.