Paypal Express Start fails when moving to pfSense firewall
-
Hi,
I've been at this for some hours now and don't understand what to do.
We have a client with an ecommerce website where people put orders into and get to select either credit card or paypal payments.
Since moving from older shorewall to pfSense a couple of nights ago, their URL:
https://www.example.com/paypal/express/start/
fails to work with an error (in Firefox) of:
_Secure Connection Failed
The connection to the server was reset while the page was loading.
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.https://support.mozilla.org/kb/what-does-your-connection-is-not-secure-mean_
Yet on the older shorewall firewall, no problems.
Chrome fails to load also this page for the website.
Has anyone got any suggestions as to how this can be trouble-shooted and resolved?
The setup is pretty simple:
1. WAN interface to the net
2. LAN interface to the DMZ
3. website on various subnets in the DMZ
Please advise.
Thank you.
-
example.com sure like hell is not PayPal. Providing bogus URL certainly does NOT help with debugging.
-
Hmm, please read:
https://tools.ietf.org/html/rfc2606
item 3. example.com is meant to be used on forums and public websites when providing example URLs, being reserved specifically for this purpose.
The important part is not the domain name, but the URL suffixes. I mentioned in the original message that it was working fine to Paypal (for many years for that matter) prior to implementing the pfSense firewalls. So Paypal obviously doesn't have an issue with their domain. They also use TruBiz ID with EV for the SSL on their website.
Please advise what you think if you can assist.
Thank you.
example.com sure like hell is not PayPal. Providing bogus URL certainly does NOT help with debugging.
-
"3. website on various subnets in the DMZ"
So you have a downstream router??
-
"3. website on various subnets in the DMZ"
So you have a downstream router??
No, we have various public subnets, some /24's some /29's.
We've setup these subnets via "Virtual IPs" on the LAN interface of the router, and setup the majority of rules on that LAN interface.
We setup Aliases for the /24, /29, etc "networks", then rules on the LAN interface for those networks.
We did the same thing in shorewall, which describes them as "zones", so migrated the same setup to pfSense.
So basically, traffic from the LAN interface (which has many Virtual IP's) goes through to WAN then through to the internet.
The WAN interface has a dedicated /29 for itself and the HA Cisco routers, which upstream to the ISP Data centre provider.
-
"setup the majority of rules on that LAN interface"
Huh?? Are they public subnets routed to you? I can not believe they are all just running on the same layer 2 if you have more than 1 of them?
Why would you be setting up aliases on the LAN???
If you have /29 for your wan, and then you have more /?? that are routed to this transit /29 then your doing it completely utterly WRONG!!! You would bring up your subnets on lan interfaces and those networks would be behind pfsense. There would be NO vips created..
You would then need to create rules on the WAN the interface connected to the internet to allow traffic to these networks behind pfsense!! Your different routed networks would be connected lan, or optX or vlans sitting on interfaces that are behind pfsense.. The rules on those interfaces would be set to allow the traffic you want them to initiate.
Rules are evaluated as traffic enters an interface from network its connected too, first rule to trigger wins, no other rules are evaluated.
Lets say your transit /29 is 1.0.0.0/29 where your gateway is 1.0.0.1, and pfsense wan IP is 1.0.0.2… You have a /24 2.2.2.0 routed to you... Then on an interface of pfsense setup its IP to 2.2.2.1/24 and your devices connected to that interface would be int he 2.2.2.0/24 network.
You are going to want to turn off NAT for these interfaces - since they are public and routed to you. You would create another interface/vlan for use by say your 3.0.0.0/29 routed network.. Pfsense IP on this interface would be say 3.0.0.1..
You would create rules on your WAN to allow traffic to 2.2.2.100 for example for https if that is the IP your https server is on.
-
-
Hi. I really thank you for your comments, I'll look at analysing your explanation in detail so as to understand the correct way to setup and configure.
At the moment, the pfSense firewalls are in production and working fine, so no major changes are going to happen.
But remember this arose from the migration of shorewall to pfSense, like for like configuration, which is why we have it the way it is.
The client ended up fixing the Paypal issue by the way, it had nothing to do with pfSense, just a total coincidence they had the problem shortly after we did the migration and put the new firewalls on-line.
Thanks again.
"setup the majority of rules on that LAN interface"
Huh?? Are they public subnets routed to you? I can not believe they are all just running on the same layer 2 if you have more than 1 of them?
Why would you be setting up aliases on the LAN???
If you have /29 for your wan, and then you have more /?? that are routed to this transit /29 then your doing it completely utterly WRONG!!! You would bring up your subnets on lan interfaces and those networks would be behind pfsense. There would be NO vips created..
You would then need to create rules on the WAN the interface connected to the internet to allow traffic to these networks behind pfsense!! Your different routed networks would be connected lan, or optX or vlans sitting on interfaces that are behind pfsense.. The rules on those interfaces would be set to allow the traffic you want them to initiate.
Rules are evaluated as traffic enters an interface from network its connected too, first rule to trigger wins, no other rules are evaluated.
Lets say your transit /29 is 1.0.0.0/29 where your gateway is 1.0.0.1, and pfsense wan IP is 1.0.0.2… You have a /24 2.2.2.0 routed to you... Then on an interface of pfsense setup its IP to 2.2.2.1/24 and your devices connected to that interface would be int he 2.2.2.0/24 network.
You are going to want to turn off NAT for these interfaces - since they are public and routed to you. You would create another interface/vlan for use by say your 3.0.0.0/29 routed network.. Pfsense IP on this interface would be say 3.0.0.1..
You would create rules on your WAN to allow traffic to 2.2.2.100 for example for https if that is the IP your https server is on.
