multiple virtual ips port forward strange lan behavior (solved)
-
hello all. my first post failed if this is a duplicate please let me know i didnt find my first
I have used pfsense at home for a few years. I am no expert. i recently installed a self built system for a Non profit Client. I will explaine the topology
5 consecutive static ip addresses from fiber isp Verizon.
Ip 1 is the main wan used for office internet traffic Lan subnet 192.168.1.0 i also set up an openvpn connection for remote maintenance. all is good works perfect Very easy to set up
IP 2 on the same isp subnet is set as a virtual ip. For that IP i have ports 80 and 443 forwarded to 192.168.1.248 a nextcloud server... I have a fqdn with dns through cloud flare dns only and lets encrypt ssl cert working fine and accessable from the internet.
IP 3 on the same isp subnet is set as a virtual ip. For that IP i have ports 80 and 443 forwarded to 192.168.1.246 an onlyoffice document server... I have a fqdn with dns through cloud flare dns only and lets encrypt ssl cert working fine and accessable from the internet.
I have the nextcloud onlyoffice connector working fine. from the internet i can edit and save docs in onlyoffice editors. all is fine
Here is the issue: When connected to the local lan (in the office or via vpn) when i go to the FQDN for nextcloud or onlyoffice i am immediately sent to the pfsense web ui login page. If i address it via the lan ip i can access nextcloud but becuase it is bypasing the ssl cert connecting nextcloud to only office fails.
I have tried to ad a dns override to forwarder but still have the same problem
do i need to set up a 1:1 for each of the web servers. Is there a way to keep local traffic on the lan and still use fqdn and ssl while in the office.
the goal is for the workers to be able to use nextcloud at home or on the road without the need to switch configurations.
any help is appreciated. thank you
-
@superprick said in multiple virtual ips port forward strange lan behavior:
I have tried to ad a dns override to forwarder but still have the same problem
That should resolve the issue if you didn't something wrong.
I'm in doubt that you're directed to the pfSense GUi if the override is set correctly.
Are your clients using pfSense for DNS?Also you should change the pfSense GUI port to something else than 80 or 443.
-
my clients are using pfsens for dns. all via dhcp. and yes it is redirected to the gui. i will change the ports
-
one mistake i am using resolver
-
ok so i changed to gui port to 444 i am no longer being directed to the pf login. but trying the fqdn it is not resolving. browser just sits there trying. i can still connect via the internet
-
Seems like your override is not working - are you trying to do a domain overrride or a host override?
If you want host.domain.tld to resolve to 192.168.1.X while your local that is a host override, if you want pfsense to go ask some specific NS when query queries for anything.domain.tld then that would domain override.
Simple enough to validate if host override is working or even domain override... Do a simple query using your fav dns client, nslookup, host, dig - what gets returned?
-
what i really want is on the local network for https://example.com to be resolved by lets say google so that the ssl cert is intact. i tried both a domain and host override dig curl both fail
maybe this is a clue. on the lan i tried to address the virtual ip directly and it fails to connect as well
-
SSL has nothing to do with DNS or the destination IP. The only thing here is that the hostname in the HTTP host header has to match the name of the virtual web server.
So if you want resolve https://example.com locally, just set an DNS host override and put "example" in the host box and "com" in the domain box.
-
@viragomann i configured the host override as you stated. and it does not work. also if i am on the lan with outbount traffic routed through isp ip x.x.x.98 shouldnt i be able to directly address in a browser x.x.x.99 and 100. this does not work. but both of these addresses connect to my servers attached to virt ip's in pfsense from another internet connection. i cant even ping these addresses from the lan
-
Nat reflection. problem solved. i turned it on enable nat reflection 1to1 and outbound all works
new to the forum how do i mark as solved -
@superprick said in multiple virtual ips port forward strange lan behavior (solved):
and it does not work
Host overrides actually take work to F up ;) they are so easy to do.
-
@superprick said in multiple virtual ips port forward strange lan behavior (solved):
dig curl both fail
You might benefit from showing your work there.
