Port Forwarding Website
-
I just installed my new SG-3100 and was adding all of my firewall rules back from my old cisco unit that may have met its death a few weeks ago. No matter what I have done I can't get my website to work. Inside the network, I get redirected to the PFsense Web GUI and outside the network, I get a connection refused. The only thing I have done to this factory install is set a static IP for my server and set up a NAT rule for port 80 to 192.168.1.2. My understanding from reading other forms is that a rule should override an internal webserver rule but it is not. I tried messing around with squid and reverse proxies but I got nowhere. Attached is a picture of the NAT configuration. Am I missing something? I just started playing around with pfSense so this could very well be a beginner problem.
-
So configure your pfSense to listen on a different port than 80 or 443 in System > Advanced > Admin Access and check the 'WebGUI redirect' option.
-
If you connect to it externally traffic will hit the portforwarder and be redirected before they ever hit the pfSense webgui so it should not matter if that's also running on port 80.
If you are connecting from the inside using the external IP, or an FQDN that resolves the external IP, then you do not hit the forwarder and instead see the webgui.
If you need to bge able to do that you need to use split DNS or NAT reflection:
https://docs.netgate.com/pfsense/en/latest/nat/accessing-port-forwards-from-local-networks.htmlHowever it seems more like your server is not responding for some reason since that port forward is correct.
Steve
-
It's definitely on the pfsense level. I tried the using my old Asus router yesterday and it works just fine when I forward the port from both internally and externally. Externally I get a connection refused and internally it just goes to the GUI. I can connect to the server via internal ip so if I go to 192.168.1.2. It works just fine. For testing I created a new installation of a web server on a new virtual machine and have the same problem.
-
Run through the troubleshooting doc.
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.htmlIf your trying to hit your public IP from inside to get redirected back in - that is a nat reflection. And in my opinion is just borked anyway..
Internally you should resolve the fqdn to is local IP.. Split dns - takes all of 2 seconds to setup.
External as you would hit the forwarder first as stephenw10 has stated...
-
If you're seeing connection refused externally rather than timing out it's hitting something.
Check the state table when you're trying to connect, filter by the source IP you're connecting from. You should see states on WAN and LAN with the translation on WAN.
Steve
