Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] How to access to server in DMZ

    Scheduled Pinned Locked Moved Firewalling
    19 Posts 4 Posters 5.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Source WAN net is not "the internet." Source any is "the internet."

      You probably need a port forward as well unless you have routed, public IP addresses on the DMZ interface.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • W
        WhiteTiger-IT
        last edited by WhiteTiger-IT

        The router has a port forward 80 on the pfSense WAN network card.
        I have changed the rule from WNA net to WAN address.
        Nonetheless:

        • in pfSense / Diagnostic / Test Port from WAN to the server address in DMZ replies with: "No output received, or connection failed. Try with" Show Remote Text "unchecked first."
        • With https://www.yougetsignal.com/tools/open-ports/ on the public address, the port 80 is closed

        This is the new snapshot of the rules in WAN and the one in DMZ.

        alt text

        alt text

        I was wondering, if the access from 192.168.0.0 is blocked by default in WAN, how does it accept traffic from the router if the rule is after that of the block?

        Bob.DigB 1 Reply Last reply Reply Quote 0
        • Bob.DigB
          Bob.Dig LAYER 8 @WhiteTiger-IT
          last edited by

          @WhiteTiger-IT said in How to access to server in DMZ:

          I have changed the rule from WNA net to WAN address.

          Why?

          1 Reply Last reply Reply Quote 0
          • W
            WhiteTiger-IT
            last edited by

            @Bob-Dig said in How to access to server in DMZ:

            @WhiteTiger-IT said in How to access to server in DMZ:

            I have changed the rule from WNA net to WAN address.

            Why?

            Because initially the rule was from WAN Net, now from WAN Address.
            Which is the right rule?

            Bob.DigB DaddyGoD 2 Replies Last reply Reply Quote 0
            • Bob.DigB
              Bob.Dig LAYER 8 @WhiteTiger-IT
              last edited by Bob.Dig

              @WhiteTiger-IT When staff give you a hint, better do it. 😉

              @Derelict said in How to access to server in DMZ:

              Source WAN net is not "the internet." Source any is "the internet."

              1 Reply Last reply Reply Quote 1
              • DaddyGoD
                DaddyGo @WhiteTiger-IT
                last edited by DaddyGo

                @WhiteTiger-IT

                What we call ourselves, (of their own free will) WAN or WAN Net, etc. is not equal with internet access ✌

                the solution is this:

                @Derelict " Source any is "the internet."

                Cats bury it so they can't see it!
                (You know what I mean if you have a cat)

                1 Reply Last reply Reply Quote 0
                • W
                  WhiteTiger-IT
                  last edited by

                  @DaddyGo
                  @Derelict
                  @Bob-Dig

                  Now in WAN there is only the rule
                  Source ANY to Alias-Server in DMZ for Alias-Port (80 + 443)

                  41/5000
                  I have left the other rules (in LAN and DMZ) unchanged, but yet I don't reach the Apache server in DMZ and ports 80 + 443 are closed from the Internet with this link

                  Do I need to add a Port Forward?
                  I already have a port forward for ports 80 + 443 on the pfSense WAN card.

                  Forgive my inexperience, but it is the first time that I work with pfSense and I create rules in a firewall.
                  I read the online manual and a couple of PDFs that I found on the net, but as regards the configuration of pfSense to manage a server in the DMZ I have not found anything that can help me.

                  If you can direct me to another reading, I am giving it to you

                  Bob.DigB 1 Reply Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @WhiteTiger-IT
                    last edited by Bob.Dig

                    @WhiteTiger-IT Show us the Port Forward-rule and the WAN-rule and while you are at it, the rest again.

                    1 Reply Last reply Reply Quote 0
                    • W
                      WhiteTiger-IT
                      last edited by

                      In pfSense there are no port forwarding rules, only the two automatically created in Outbound.
                      This is the WAN screenshot about rules.
                      alt text

                      This is the screenshot of the router
                      alt textt

                      Bob.DigB 1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8 @WhiteTiger-IT
                        last edited by Bob.Dig

                        @WhiteTiger-IT In a normal setup, your router would forward those or any ports to the pfSense WAN-Interface and then you would need to port froward from there to your actual server. So you would need to portforward in pfSense too, doing double-NAT. But maybe your setup is different, but you haven't told us in your first post.

                        W 1 Reply Last reply Reply Quote 0
                        • W
                          WhiteTiger-IT @Bob.Dig
                          last edited by

                          @Bob-Dig said in How to access to server in DMZ:

                          @WhiteTiger-IT In a normal setup, your router would forward those or any ports to the pfSense WAN-Interface and then you would need to port froward from there to your actual server. So you would need to portforward in pfSense too, doing double-NAT. But maybe your setup is different, but you haven't told us in your first post.

                          I am now starting to configure pfSense in my "personal laboratory" to learn how to use it.
                          The rules entered are those that I also viewed in previous posts. There are no other rules and these are used to access the server from my PC and to make updates.
                          These are rules that I took from the official help.
                          In DMZ there is an Apache with only the default page, to do the tests I think it is enough.

                          Bob.DigB 1 Reply Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8 @WhiteTiger-IT
                            last edited by Bob.Dig

                            @WhiteTiger-IT So you haven't changed any settings in pfSense (System - Advanced - Firewall & NAT), then pfSense is its own router and you have to do double-NAT, like I said.

                            W 1 Reply Last reply Reply Quote 0
                            • W
                              WhiteTiger-IT @Bob.Dig
                              last edited by

                              @Bob-Dig said in How to access to server in DMZ:

                              So you haven't changed any settings in pfSense (System - Advanced - Firewall & NAT), then pfSense is its own router and you have to do double-NAT, like I said.

                              I have now created this NAT Port Forward rule.
                              Is this what you mean?
                              alt text

                              Bob.DigB 1 Reply Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8 @WhiteTiger-IT
                                last edited by

                                @WhiteTiger-IT More like this:
                                Capture.PNG

                                1 Reply Last reply Reply Quote 0
                                • W
                                  WhiteTiger-IT
                                  last edited by

                                  I changed the NAT rule and didn't use aliases.
                                  But now using the URL http: // IP-Address I get the Tunnel Connection Failed error

                                  alt text

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    WhiteTiger-IT
                                    last edited by WhiteTiger-IT

                                    Using a DDNS I get the error Connection Timed out
                                    I don't find error in Syslog / Firewall

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      WhiteTiger-IT
                                      last edited by

                                      Last week I contacted the ISP that manages the firewall; they told me that they were no problems and that is pfSense not to have the ports open.
                                      How can I check if it is true?
                                      I can only use tools on the Internet and this tells me that the doors are closed on the public address.
                                      If from pfSense Diagnostic I ping from WAN on the server, it doesn't work, but maybe this is not enabled.

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        WhiteTiger-IT
                                        last edited by

                                        AAARGHHHH!
                                        DAMNED DHCP THAT CHANGED THE ADDRESS OF THE WAN CARD!

                                        Everything is working!
                                        I apologize very much and thank you for your support and patience!

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.