Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can access web server externally, but not from LANs.

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 4 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      PITS_King @Gertjan
      last edited by

      This post is deleted!
      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        What did you do with the Redirect IPv4 Gateway - Force all client-generated IPv4 traffic through the tunnel checkbox in the server configuration?

        If unchecked (or if you have set the equivalent of Don't pull routes in the client configuration) what are the Local Networks defined in your OpenVPN server.

        One issue at a time please. Please provide as much detail as possible. You have the benefit of being able to choose the first one / prioritize.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        P 1 Reply Last reply Reply Quote 0
        • P
          PITS_King @Derelict
          last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • P
            PITS_King @Derelict
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by Derelict

              If you have Redirect IPv4 Gateway checked AND you are not telling the client not to pull routes, you do not need any custom options to push any routes. You will get two routes on the client into the tunnel 0.0.0.0/1 and 128.0.0.0/1. That covers all IPv4 addresses without clobbering the client's default route. The netmask is longer (/1 is longer than /0) so those routes are preferred in the routing table over 0.0.0.0/0.

              With that in place, connect to the VPN and attempt a connection (a single connection like to http://10.0.1.4:10000/ (or https or whatever it is supposed to be).

              What, exactly, happens.

              Then go to Diagnostics > Packet Capture and set the following:

              Interface: The interface the server is on. The 10.0.1.0/24 interface
              Host: 10.0.10.0/24
              Port: 10000
              Count: 100000

              Start

              Test connecting to 10.0.1.4:10000 and let it fail

              Stop the capture. What do you see?

              If you see nothing, move the packet capture to the OpenVPN interface and do the same thing. What do you see?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                An aside: you should not be using Custom Options to push routes. You would use the Local Networks form field that would become visible if you unchecked Redirect IPv4 Gateway

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                P 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @PITS_King
                  last edited by

                  @PITS_King said in Can access web server externally, but not from LANs.:

                  Yes, it was ruled by Congress that it is illegal for an ISP to block ANY port.

                  You do understand they repealed net neutrality right ;)

                  The mail server running on the Virtualmin server is only handling contact forms on a publicly visible website.

                  Then you have ZERO use for an inbound 25 port..

                  Internal connectivity has ZERO to do with any port forwards.. So yeah you can forget all of those.. And have arleady stated all you have to do for internal - your firewall rules already allow all traffic, so you issue of connectivity between your vlans comes down to name resolution or host firewall.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  P 1 Reply Last reply Reply Quote 0
                  • P
                    PITS_King @Derelict
                    last edited by PITS_King

                    This post is deleted!
                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      @PITS_King said in Can access web server externally, but not from LANs.:

                      Just to confirm, should I replace the 3 LAN addresses I defined in IPv4 Local Network(s) to 0.0.0.0/1 and 128.0.0.0/1 to have everything working 100%?

                      It depends on what you want. There is no one answer. It's up to you.

                      If it's working, no.

                      If you want to push routes to the other side that tell them to send all traffic to you, check Redirect IPv4 Gateway.

                      If you want to send all traffic out the OpenVPN tunnel, then that would be a Remote Network on your side instead of a Local Network Local networks push routes to clients so they send traffic to you. Remote networks add kernel routes to the local routing table that get traffic into OpenVPN to send out a tunnel.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • P
                        PITS_King @johnpoz
                        last edited by

                        This post is deleted!
                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          @PITS_King said in Can access web server externally, but not from LANs.:

                          Then, on to getting Snort and Suricata back up and running! :-)

                          So you have your internal working... I sure wouldn't start playing with those until you do, and you sure and the F do not need both.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.