Https NAT not working

Derelict · Sep 28, 2016, 2:15 AM

Then it would be working.

Even if the pfsense webgui was listening on 443 a port forward on WAN would take precedence.

Post what you have done.

NOYB · Sep 28, 2016, 2:18 AM

Ah, well that changes everything. I was reading it as though you… well I think you know how I was reading it.

Maybe if you could show us the NAT rule would help.

khansen · Sep 28, 2016, 2:31 AM

created NAT rules and firewall rules were created automatically.

Derelict · Sep 28, 2016, 2:46 AM

That all looks fine. Not sure why your HTTPS rules are TCP/UDP instead of just TCP but that shouldn't hurt anything.

I conclude there is something on 192.168.1.6 that is misbehaving on port 443 and it's not pfSense.

Next step is probably Diagnostics > States, Diagnostics > Packet Capture, or logs from the server at 192.168.1.6.

NOYB · Sep 28, 2016, 2:59 AM

Is the web server currently configured to listen on 443 or 444?

Since when you disabled the web config redirect rule and changing port, have you rebooted pfSense? If not it may be worth a try just for grins.

Probably a really long shot, but have you tried clearing browser cache?

Derelict · Sep 28, 2016, 2:59 AM

Completely unnecessary.

NOYB · Sep 28, 2016, 3:01 AM

@Derelict:

Completely unnecessary.

Supposed to be, yes I know that. That's why I said just for grins. Weird things do sometimes happen.

Derelict · Sep 28, 2016, 3:04 AM

Generally not.

khansen · Sep 28, 2016, 3:06 AM

Configured for 444 right now and no I did not reboot after changing the web redirect.

I will give this a try in a few.

@Derelict:

I conclude there is something on 192.168.1.6 that is misbehaving on port 443 and it's not pfSense.

Next step is probably Diagnostics > States, Diagnostics > Packet Capture, or logs from the server at 192.168.1.6.

Ok I will look at it again, I know there are a few other services that have their own webserver but I did not see them with netstat or lsof on port 443.

Thanks for the input though, I've been fighting this for a while.

khansen · Sep 28, 2016, 3:08 AM

And it was also a fresh apache2 install and it gave no errors when starting, just a little more info..

NOYB · Sep 28, 2016, 3:09 AM

If web server is configured to listen on 444 then the 443 rule is not going to work.

Derelict · Sep 28, 2016, 3:13 AM

You could port forward from 443 to 444 though.

Set the dest port to 443 and the NAT port to 444.

khansen · Sep 28, 2016, 3:23 AM

@Derelict:

You could port forward from 443 to 444 though.

Set the dest port to 443 and the NAT port to 444.

Tried this and 'site cant be reached' 'err_connection_timed_out'

Derelict · Sep 28, 2016, 3:25 AM

That will only work if your TLS web server is listening on 444. Only you know what's going on on your network/servers.

khansen · Sep 28, 2016, 3:33 AM

From local network

Derelict · Sep 28, 2016, 5:44 AM

Then I guess you need to figure out why connections from outside aren't completing. Packet capture on LAN port 444 and post.

khansen · Sep 29, 2016, 3:31 AM

Solved !!
Well not really but after 2 hours of tcpdump and no traffic ever reaching port 443, I decided to look at the trusty Uverse gateway for info I saw that it has port 443 used for the WAP if you have any wireless receivers, and then a quick little google turned up the the same from ATT.

After redoing the NAT on 444 to 444 the webserver does work.
Not an ideal solution, but its all I have now.

Thank you to everyone that responded.

Derelict · Sep 29, 2016, 3:53 AM

#5 on this list: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

khansen · Sep 29, 2016, 4:52 AM

@Derelict:

#5 on this list: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

Agreed, I just never thought it would be used by them for device control and I haven't always had the wireless receivers, and 443 has worked for me in the past.