• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Unable to access pfsense box using hostname from LAN

Scheduled Pinned Locked Moved DHCP and DNS
16 Posts 4 Posters 7.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • N
    Nikolay_Zhelev
    last edited by Jul 6, 2016, 7:03 PM

    Hi fellow,

    I cannot access my pfsense box using it's hostname.domain from my LAN. From outside network it's fine, but from LAN it's impossible. The only way I can access the box from LAN is it's local IP address.

    pfsense 2.3.1-RELEASE-p5 (amd64)

    Help from your side will be highly appreciated.

    Regards,
    Nick

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by Jul 6, 2016, 8:21 PM

      so I take it your hostname.domain your using is resolving to your public IP..  Why do you not just use a hostname.domain that resolves to your LAN ip..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • N
        Nikolay_Zhelev
        last edited by Jul 6, 2016, 8:34 PM

        Dear John,

        Thank you for your quick reply.

        Exactly, I'm trying to use my public hostname.domain from my LAN.

        Actually I don't want to use different hostname and domain for my LAN, it's just inconvenient to switch to different hostname.domain when I'm connected to my local network.

        I'm sure pfSense has the capability to resolve my public hostname.domain from my lan, actually when I ping my box using my public hostname.domain it replies from my local IP, but I don't know why my browser can't resolve it from my LAN.

        Regards,
        Nick

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by Jul 6, 2016, 9:16 PM

          well is your browser using a proxy?

          so when when you ping this hostname.domain from your lan what comes back.  Why do you feel you should use your public domain on your local network IP?  This make no sense to me to be honest.  So for example my pfsense locally is known as pfsense.local.lan This is how I access it be it local or even when I vpn into my network.  This lan IP has nothing to do with public name.  I do have a few public names that point to my public IP.  But not sure why anyone would want these to be the same?

          To be honest once you create a bookmark to the web gui when your local what does it matter if its a fqdn that resolves on the public internet a local domain or even just an IP..

          Do you really have your web gui interface open to the public internet??  That is a really bad idea!!!

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • N
            Nikolay_Zhelev
            last edited by Jul 7, 2016, 4:54 AM

            Dear John,

            Thanks for the activity. Actually you're right in terms of remote access to my web-interface, it's quite dangerous, but it's a backup plan if something happens to my box and I'm away from home.

            Anyway the only reason trying to use my public hostname.domain is my SSL certificate. When I use another local hostname.domain the SSL certificate is self-signed and it's just inconvenient.

            If there is a chance to use my public hostname.domain in  my local network, honestly I would prefer it.

            I'm looking forward to hearing from you.

            –-
            Regards,
            Nick

            1 Reply Last reply Reply Quote 0
            • D
              Derelict LAYER 8 Netgate
              last edited by Jul 7, 2016, 9:11 AM

              Yes.

              Set a host override in your inside DNS server (probably pfSense DNS Resolver or Forwarder) that returns your inside address when the hostname is queried.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Jul 7, 2016, 10:09 AM

                Use of public domain name because have a signed public cert is again bad logic..  You do understand that pfsense has a CA you can create as many certs as you want for any fqdn you want.  Who exactly accesses this gui - you?  So why does it need to be trusted by the planet at large?  How many different users/browsers access this?

                Just create a cert with the name you use internally and then have your browser trust that CA - 2 seconds of work and there you go pretty green icon when you access your pfsense via its local fqdn..

                So you open your gui to the public as a backup??  Why do you not just vpn if you need to make adjustments to your pfsense settings?  If you need another backup??  I would suggest have someone run teamviewer on a box or run it as a service.  this is more secure than opening up your admin gui for your firewall to the public with a usrename/password as your protection.

                Or sure you could just use an override as Derelict suggest but I feel that is a work around more than proper setup.

                selfsigned.jpg
                selfsigned.jpg_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • G
                  gjaltemba
                  last edited by Jul 7, 2016, 5:04 PM

                  I created a CA and certificate in pfSense. When I import the CA into Firefox Certificates->Authorities, it results in

                  SEC_ERROR_INADEQUATE_CERT_TYPE

                  I remove the CA and add the cert as exception to get webgui going. What am I doing wrong?

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by Jul 7, 2016, 5:55 PM

                    So did you create a Server Cert? From that CA and set your web gui to use that server cert?

                    So for example here is me importing mine.. So you can see the ca I created pfsense-ca (very original naming conventtion) hehee There is the cert I created that you can see my webconfig is using with the cn of pfsense.local.lan

                    I exported the CA, and then imported it into firefox trusted.. There you 2 seconds and Bobs your Uncle!

                    trustcainfirefox.jpg
                    trustcainfirefox.jpg_thumb

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • G
                      gjaltemba
                      last edited by Jul 7, 2016, 6:57 PM

                      Thanks. Silly me. I created a user cert. Much better with server cert.

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by Jul 7, 2016, 7:30 PM

                        That happens way more than you know ;) or would even think possible really… So your saying the web gui came up even using a user cert.. That seems unlikely..  Even if you made exceptions I would think it should even work.

                        Mostly see it on the openvpn section.. Should prob be Big Bold letters with examples of usage for the 2 different types...

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • G
                          gjaltemba
                          last edited by Jul 7, 2016, 8:14 PM

                          The webgui comes up with a user cert same as using the webConfigurator default cert. It is added as an exception so no green icon but a yellow icon.

                          1 Reply Last reply Reply Quote 0
                          • J
                            johnpoz LAYER 8 Global Moderator
                            last edited by Jul 9, 2016, 11:15 AM Jul 9, 2016, 10:24 AM

                            I have no idea what your doing wrong dude - its 10 seconds to do this.. I have shown you the full setup..  What cert that is being used - if you have it using a user cert than yeah its going to be hosed..  Why would you create a user cert for a webserver??

                            As you saw before the name on the cert was strongcert, that is what is being used by my web config, here showing it in the actual web config area.  You can see I have a green icon, you can see that the cert used is signed by my pfsense-ca and that its usage is for webserver auth..

                            Post the details of your ca, your cert your using in for web configurator in pfsense and then what cert and what fqdn your using to access the gui..  And the details it shows about the cert.  If you want open it up remote and I will set it up in 10 seconds ;)

                            edit:  Here just created a new cert, calling it my supercert I bumped it to 4096 with a sha fo 512.. I also added the IP and another name from one of my other networks wlan.local.lan which on my 192.168.2/24 segment.  I then added that pfsense.wlan.local.lan to my alternative names in the admin section to preven the rebind and reffer protection if hitting that altname.  I changed the web config to use the new supercert.  And there you go can access with green on 2 different pfsense names and their IP address.  Notice the cert is valid for all those uri

                            cert.jpg
                            cert.jpg_thumb
                            newcert.jpg_thumb
                            newcert.jpg

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • G
                              gjaltemba
                              last edited by Jul 10, 2016, 5:35 AM

                              No. No. It is all good now with your excellent instructions. I also generated certs for my Cisco switch using Cert Manager and openssl. Now I get a green icon in pfSense gui and Cisco switch gui too.

                              Thank you for your help.

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by Jul 10, 2016, 12:01 PM

                                Then what was this about?

                                "The webgui comes up with a user cert same as using the webConfigurator default cert."

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • G
                                  gjaltemba
                                  last edited by Jul 10, 2016, 1:10 PM

                                  Sorry. Too much information.

                                  My goof was in creating the cert and did not change setting to type server.

                                  1 Reply Last reply Reply Quote 0
                                  1 out of 16
                                  • First post
                                    1/16
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                    This community forum collects and processes your personal information.
                                    consent.not_received