How to keep the webserver can be accessed from the internet?
-
Where are you scanning from? You understand pfsense has zero to do with communication between webserver 1 and 2.. They are on the same network.
Rules are evaluated top down as the traffic enters an interface. So if you want to stop something on the lan from talking to dmz or wan/internet then sure lan is the place to put them. But its top down, first rule to fire wins - no other rules are evaluated.
If you were scanning from WAN to lan.. Al traffic would be blocked out of the box.. Where are you scanning from exactly to where?
-
Where are you scanning from? You understand pfsense has zero to do with communication between webserver 1 and 2.. They are on the same network.
Rules are evaluated top down as the traffic enters an interface. So if you want to stop something on the lan from talking to dmz or wan/internet then sure lan is the place to put them. But its top down, first rule to fire wins - no other rules are evaluated.
If you were scanning from WAN to lan.. Al traffic would be blocked out of the box.. Where are you scanning from exactly to where?
I scan in one network with the webserver 192.168.200.3
-
Try something like this to scan your WAN ports
https://www.grc.com/x/ne.dll?bh0bkyd2
Click "Proceed" then click "All Service Ports" Right now, unless you've written rules on WAN, they will all be closed.You'll need to write rules on WAN to open the specific ports you need to access your webservers.
Write the rules you need then rescan and you will see them open. -
-
Try something like this to scan your WAN ports
https://www.grc.com/x/ne.dll?bh0bkyd2
Click "Proceed" then click "All Service Ports" Right now, unless you've written rules on WAN, they will all be closed.You'll need to write rules on WAN to open the specific ports you need to access your webservers.
Write the rules you need then rescan and you will see them open.rule on WAN
The scanning results
NAT configuration through the WAN interface of the free wifi. and pfsense I run in vmware.
-
Pfsense has ZERO to do with those webservers talking to each other.
-
Read this:
https://calvin.me/port-forward-web-servers-in-pfsense-2/I followed the tutorial so 192.168.200.3 accessible to the public, but instead can not access public 192.168.200.3.
if there is something wrong with my configuration? please correct
-
Pfsense has ZERO to do with those webservers talking to each other.
Okay, I understand. thank you.
but I still have not read webserver public :D -
Allowing access to pfsense web gui from the public internet is a BAD idea.. even if you change the port.
If you want your webservers to be available behind pfsense that would be a port forward.
-
Source address WAN net is not the internet, it is the subnet of the WAN interface. Source any is the internet.
And the destination should be the INSIDE ADDRESS of the port forward. The REAL ADDRESS of the server, such as 192.168.200.3.
-
Allowing access to pfsense web gui from the public internet is a BAD idea.. even if you change the port.
If you want your webservers to be available behind pfsense that would be a port forward.
yes I just tried that a publicly accessible webserver
-
I merged these. Same topic. Also moving to NAT.
-
Did you forward the ports from the nat router in front of pfsense? Pfsense can not forward something that never gets to it..
If you can not figure what your doing wrong - look over the troubleshooting doc..
https://doc.pfsense.org/index.php/Port_Forward_TroubleshootingIf your trying to simulate coming from the internet by coming from the wan that is rfc1918.. Your going to have to make sure your uncheck block rfc1918 on the wan interface..
-
-
Did you forward the ports from the nat router in front of pfsense? Pfsense can not forward something that never gets to it..
If you can not figure what your doing wrong - look over the troubleshooting doc..
https://doc.pfsense.org/index.php/Port_Forward_TroubleshootingIf your trying to simulate coming from the internet by coming from the wan that is rfc1918.. Your going to have to make sure your uncheck block rfc1918 on the wan interface..
OK I will try it
