Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Https NAT not working

    NAT
    3
    22
    3295
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      khansen last edited by

      pfSense 2.3.2
      webguiredirect is disabled
      webconfigurator is set for https on port 8443

      NAT is working for 80, openvpn and other ports but not for 443.
      I moved webserver https port to 444 and created nat rule and it works fine, but when using 443 in a browser I get err_empty_response

      Any ideas?

      Thank you

      1 Reply Last reply Reply Quote 0
      • N
        NOYB last edited by

        What response are you expecting to get?

        From what you outlined it seems like maybe there is nothing listening on 443.

        1 Reply Last reply Reply Quote 0
        • K
          khansen last edited by

          @khansen:

          I moved webserver https port to 444 and created nat rule and it works fine, but when using 443 in a browser I get err_empty_response

          Webserver was configured to listen on 443 and there should have been a comma between 443 and browser

          1 Reply Last reply Reply Quote 0
          • Derelict
            Derelict LAYER 8 Netgate last edited by

            Then it would be working.

            Even if the pfsense webgui was listening on 443 a port forward on WAN would take precedence.

            Post what you have done.

            Chattanooga, Tennessee, USA
            The pfSense Book is free of charge!
            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • N
              NOYB last edited by

              Ah, well that changes everything.  I was reading it as though you… well I think you know how I was reading it.

              Maybe if you could show us the NAT rule would help.

              1 Reply Last reply Reply Quote 0
              • K
                khansen last edited by

                created NAT rules and firewall rules were created automatically.










                1 Reply Last reply Reply Quote 0
                • Derelict
                  Derelict LAYER 8 Netgate last edited by

                  That all looks fine. Not sure why your HTTPS rules are TCP/UDP instead of just TCP but that shouldn't hurt anything.

                  I conclude there is something on 192.168.1.6 that is misbehaving on port 443 and it's not pfSense.

                  Next step is probably Diagnostics > States, Diagnostics > Packet Capture, or logs from the server at 192.168.1.6.

                  Chattanooga, Tennessee, USA
                  The pfSense Book is free of charge!
                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • N
                    NOYB last edited by

                    Is the web server currently configured to listen on 443 or 444?

                    Since when you disabled the web config redirect rule and changing port, have you rebooted pfSense?  If not it may be worth a try just for grins.

                    Probably a really long shot, but have you tried clearing browser cache?

                    1 Reply Last reply Reply Quote 0
                    • Derelict
                      Derelict LAYER 8 Netgate last edited by

                      Completely unnecessary.

                      Chattanooga, Tennessee, USA
                      The pfSense Book is free of charge!
                      DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • N
                        NOYB last edited by

                        @Derelict:

                        Completely unnecessary.

                        Supposed to be, yes I know that.  That's why I said just for grins.  Weird things do sometimes happen.

                        1 Reply Last reply Reply Quote 0
                        • Derelict
                          Derelict LAYER 8 Netgate last edited by

                          Generally not.

                          Chattanooga, Tennessee, USA
                          The pfSense Book is free of charge!
                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • K
                            khansen last edited by

                            Configured for 444 right now and no I did not reboot after changing the web redirect.

                            I will give this a try in a few.

                            @Derelict:

                            I conclude there is something on 192.168.1.6 that is misbehaving on port 443 and it's not pfSense.

                            Next step is probably Diagnostics > States, Diagnostics > Packet Capture, or logs from the server at 192.168.1.6.

                            Ok I will look at it again, I know there are a few other services that have their own webserver but I did not see them with netstat or lsof on port 443.

                            Thanks for the input though, I've been fighting this for a while.

                            1 Reply Last reply Reply Quote 0
                            • K
                              khansen last edited by

                              And it was also a fresh apache2 install and it gave no errors when starting, just a little more info..

                              1 Reply Last reply Reply Quote 0
                              • N
                                NOYB last edited by

                                If web server is configured to listen on 444 then the 443 rule is not going to work.

                                1 Reply Last reply Reply Quote 0
                                • Derelict
                                  Derelict LAYER 8 Netgate last edited by

                                  You could port forward from 443 to 444 though.

                                  Set the dest port to 443 and the NAT port to 444.

                                  Chattanooga, Tennessee, USA
                                  The pfSense Book is free of charge!
                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    khansen last edited by

                                    @Derelict:

                                    You could port forward from 443 to 444 though.

                                    Set the dest port to 443 and the NAT port to 444.

                                    Tried this and 'site cant be reached'  'err_connection_timed_out'

                                    1 Reply Last reply Reply Quote 0
                                    • Derelict
                                      Derelict LAYER 8 Netgate last edited by

                                      That will only work if your TLS web server is listening on 444. Only you know what's going on on your network/servers.

                                      Chattanooga, Tennessee, USA
                                      The pfSense Book is free of charge!
                                      DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        khansen last edited by

                                        From local network


                                        1 Reply Last reply Reply Quote 0
                                        • Derelict
                                          Derelict LAYER 8 Netgate last edited by

                                          Then I guess you need to figure out why connections from outside aren't completing. Packet capture on LAN port 444 and post.

                                          Chattanooga, Tennessee, USA
                                          The pfSense Book is free of charge!
                                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            khansen last edited by

                                            Solved !!
                                            Well not really but after 2 hours of tcpdump and no traffic ever reaching port 443, I decided to look at the trusty Uverse gateway for info I saw that it has port 443 used for the WAP if you have any wireless receivers, and then a quick little google turned up the the same from ATT.

                                            After redoing the NAT on 444 to 444 the webserver does work.
                                            Not an ideal solution, but its all I have now.

                                            Thank you to everyone that responded.




                                            1 Reply Last reply Reply Quote 0
                                            • Derelict
                                              Derelict LAYER 8 Netgate last edited by

                                              #5 on this list: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                                              Chattanooga, Tennessee, USA
                                              The pfSense Book is free of charge!
                                              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                              1 Reply Last reply Reply Quote 0
                                              • K
                                                khansen last edited by

                                                @Derelict:

                                                #5 on this list: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                                                Agreed, I just never thought it would be used by them for device control and I haven't always had the wireless receivers, and 443 has worked for me in the past.

                                                1 Reply Last reply Reply Quote 0
                                                • First post
                                                  Last post