Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can access web server externally, but not from LANs.

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 4 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      PITS_King @Derelict
      last edited by

      This post is deleted!
      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        So are you running an authoritative NS? The only reason that 53 needs to be open to the public would be that or say running pfblocker something like pihole for outside your network users.

        The optimal setup for wanting to use a public fqdn that resolves to say public 1.2.3.4 IP, would be to just use a host override so your internal dns resolves it to the rfc1918 address - say this 10.0.1.4 IP.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        GertjanG P 2 Replies Last reply Reply Quote 0
        • GertjanG
          Gertjan @johnpoz
          last edited by Gertjan

          @johnpoz said in Can access web server externally, but not from LANs.:

          So are you running an authoritative NS?

          963 bytes of traffic while other NAT rules already handled several GB -> so no way. Not a name server on a local LAN.
          Most ISP will block the access to port '53' - mine does. Normally, these do not have their place at an @home or 'work' network.

          Note : I guess it's a SOHO network because of the presence of a "WLAN "network.

          My first reaction was, seeing all the WAN interfaces (NAT) rules : the mstsc or RDP is missing !
          Very nice : ESXi and MySQL are listed !

          No advise from my side, but I will light a a candle for @PITS_King when I come home.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          P 1 Reply Last reply Reply Quote 2
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Yeah there are lot of ports open there that shouldn't be most likely, and prob not even needed at all.

            Openvpn to server behind is going to be pain the ass to access other boxes on his network with.. He made no mention creating the routes that would be needed to do that, etc.

            Looks like he has openvpn open to pfsense, so why would you want/need to server behind?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • P
              PITS_King @johnpoz
              last edited by

              This post is deleted!
              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @PITS_King
                last edited by

                @PITS_King said in Can access web server externally, but not from LANs.:

                I found my ISP is illegally blocking inbound SMTP on 2

                Don't feel mistreated. That happened to all of use on planet earth since ... 2005.
                Basic ISP's do not accept incoming (to you) connections to your own mail servers - and also : you can only use port "25" outgoing connections to a mail server handled by your ISP (and no other 25 mail servers).
                They finally understood that "port 25 connections" should be reserved for communication between real mail servers.
                Mail clients on your LAN(s) should use port 587 or (better) port 465 to deposit mail for transport.

                Also : the IP's used by ISP's are all listed in databases, and no serious mail server will accepts mails from these IP's because they are listed. This means : mail servers like Microsoft (MSN, Oulook, Hotmail, etc etc), gmail, Yahoo, etc etc will accept mail from your mail server.

                Do you really have a mail server running on your LAN's ? You https://www.mail-tester.com/ to send that site a test mail from your server, and checkout the results ... ^^ (did you get the 10/10 ??)

                If you really want your own mail server (and name server for your domain(s)), I advise you to rent a small VPS on the Internet.
                Then you can amuse** yourself with 'postfix' and 'bind'

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                P 1 Reply Last reply Reply Quote 0
                • P
                  PITS_King @Gertjan
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • P
                    PITS_King @Gertjan
                    last edited by

                    This post is deleted!
                    1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan
                      last edited by

                      I guess you can remove (== red) these :

                      d56c057a-1017-4f65-a9f4-e5ce547d1c4d-image.png

                      As you already have a - or 2 - incoming VPN connections, I advise you to remove blow up every NAT rule.
                      If needed, you have access to everything from the outside, using VPN.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      P 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        @PITS_King said in Can access web server externally, but not from LANs.:

                        is illegally blocking inbound SMTP on 25,

                        No I don't think it can be considered illegal, as Gertjan stated pretty much all residential connections block this and even if they didn't as Gertjan also correctly goes over wouldn't do you any good, other then sending to maybe some smaller domains. All the major player will not accept mail from you anyway.

                        Many home isp connections clearly state in their TOS that you are not to run servers.. So they can just not allow those ports since its in their TOS that your not suppose to do it, which you agreed to when you signed up be it you read them or not.

                        Even open - your isp not going to allow you edit your PTR for your IP, and when that doesn't match the name your mail server gives when trying to send mail, would also be denied - your just some want a be spammer in their minds.. Since any real mail server would follow all the RFCs in running a mail server, etc.

                        The software your running is designed to be run on a public connection... And then sure if you were running those services they would have to be open on your firewall.. But you would want or really need those open on a HOME connection..

                        If I get a few minutes here today, will draw up a basic connection drawing and we can work from there on getting your services working locally. And then how to get the services you do want/need to provide to the internet that make sense and can be done realistically..

                        But also as @Gertjan correctly mentions - if you want to play with some of this stuff and serving up to the public you prob better off doing that on VPS somewhere then off your local "home" connection be it mail or other services.

                        Lets start with your local stuff working and accessing your local resources be a fqdn you want to use.. So if that is the case you could remove ALL of those port forwards.. Port forwards are only required for access externally not for lan to other lan access.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        P 1 Reply Last reply Reply Quote 0
                        • P
                          PITS_King @johnpoz
                          last edited by

                          This post is deleted!
                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by Derelict

                            What is the source address of the client you are testing from?

                            What is real IP address on the server you are trying to connect to?

                            What port are you trying to connect to?

                            How are you testing?

                            What is the result?

                            How many FQDNs to the WAN address are we talking about?

                            Please limit your answer to one port on one server only. Fix that and you'll probably know how to fix them all.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            P 1 Reply Last reply Reply Quote 0
                            • P
                              PITS_King @Gertjan
                              last edited by

                              This post is deleted!
                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                What did you do with the Redirect IPv4 Gateway - Force all client-generated IPv4 traffic through the tunnel checkbox in the server configuration?

                                If unchecked (or if you have set the equivalent of Don't pull routes in the client configuration) what are the Local Networks defined in your OpenVPN server.

                                One issue at a time please. Please provide as much detail as possible. You have the benefit of being able to choose the first one / prioritize.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                P 1 Reply Last reply Reply Quote 0
                                • P
                                  PITS_King @Derelict
                                  last edited by

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    PITS_King @Derelict
                                    last edited by

                                    This post is deleted!
                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by Derelict

                                      If you have Redirect IPv4 Gateway checked AND you are not telling the client not to pull routes, you do not need any custom options to push any routes. You will get two routes on the client into the tunnel 0.0.0.0/1 and 128.0.0.0/1. That covers all IPv4 addresses without clobbering the client's default route. The netmask is longer (/1 is longer than /0) so those routes are preferred in the routing table over 0.0.0.0/0.

                                      With that in place, connect to the VPN and attempt a connection (a single connection like to http://10.0.1.4:10000/ (or https or whatever it is supposed to be).

                                      What, exactly, happens.

                                      Then go to Diagnostics > Packet Capture and set the following:

                                      Interface: The interface the server is on. The 10.0.1.0/24 interface
                                      Host: 10.0.10.0/24
                                      Port: 10000
                                      Count: 100000

                                      Start

                                      Test connecting to 10.0.1.4:10000 and let it fail

                                      Stop the capture. What do you see?

                                      If you see nothing, move the packet capture to the OpenVPN interface and do the same thing. What do you see?

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        An aside: you should not be using Custom Options to push routes. You would use the Local Networks form field that would become visible if you unchecked Redirect IPv4 Gateway

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        P 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @PITS_King
                                          last edited by

                                          @PITS_King said in Can access web server externally, but not from LANs.:

                                          Yes, it was ruled by Congress that it is illegal for an ISP to block ANY port.

                                          You do understand they repealed net neutrality right ;)

                                          The mail server running on the Virtualmin server is only handling contact forms on a publicly visible website.

                                          Then you have ZERO use for an inbound 25 port..

                                          Internal connectivity has ZERO to do with any port forwards.. So yeah you can forget all of those.. And have arleady stated all you have to do for internal - your firewall rules already allow all traffic, so you issue of connectivity between your vlans comes down to name resolution or host firewall.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          P 1 Reply Last reply Reply Quote 0
                                          • P
                                            PITS_King @Derelict
                                            last edited by PITS_King

                                            This post is deleted!
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.