Can't reach LAN DICOM server (8042 104) [SOLVED!]

jlc87

Hello to everyone!
I'm new with pfSense, been working with smoothwall and clearos.
This pfS box is in a public hospital, where I work at. Just added Squid package.
Thanks to all of you, and your information I got it working almost immediately, but got a problem: we distribute digital imaging from xray and other sources to every patient attention point, with Orthanc, a opensource DICOM server that listens for new studies at port 104 and serves a webapp on port 8042.
Since I installed the pfSense box, i can't reach the server at 8042 port (smb, 80, ftp, rpc, etc is ok) and the server can't get new images from the digitalizer (port 104 communication)
I already tried disabling Squid and added any to any rules in firewall.
What could it be that i'm overlooking?

Thanks a lot in advance!!!

johnpoz

Can't get to it from where? Some other lan segment, the wan?

Your going to want to draw up where this dicom sits in your network and how that attaches to pfsense, and where you can not reach it from.

jlc87

Thanks a lot for answering! The network is something like this:

They are all in the same local network and IP subnet.
Using advancedportscanner in the orthanc server, shows 8042 y 104 open, among others. Scanning the orthanc server from other pc shows the usual ports except 8042 and 104.

Edit: I forgot: i'm trying to access the webapp from the "rest of the lan"

KOM

I assume that you're trying to reach this LAN server via its FQDN? If so, you can either enable a NAT Reflection mode, or you can add a DNS override to resolve its FQDN to its LAN IP address. You should have your clients set to bypass the proxy for local addresses as well.

https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks

johnpoz

"They are all in the same local network and IP subnet."

Then pfsense has ZERO to do with that access.. So unless your trying to access it with some FQDN that resolve to say pfsense WAN IP..

See link KOM pointed out..

The correct fix would be to have your DNS return the local IP for this box vs any sort of public IP for clients on your local lan. This is a simple host override if using pfsense for dns.. If your clients are using some other dns then make the setting there. If clients are using public dns then you have bigger fish to fry.

Nat reflection is an abomination and should only be used when no other method is viable. Like do not control dns or clients dns settings, etc.

jlc87

Thanks a LOT jhonpoz and KOM!!!! (i think I ran out of forum's thanks)

You where totally right, pfsense was ZERO to do.

Fricking Windows Firewall on the Orthanc PC was self activated when I changed the default gateway.

Turned off to check and it connected like a charm! Already working on the exceptions.

Thanks again for your time!

Greetings from Patagonia Argentina!