cant get access from outside to webpage

[pooperman]

@stephenw10 said in cant get access from outside to webpage:

Ok, it looks like the firewall rules on WAN allowing access to HASProxy are disabled. Is that still the case?

Of so, enable them and enabled logging on those rules so you can see when connections are coming in. Then retest via the phone and make sure you see passed traffic from the phone IP in the firewall log?

Steve

when I took the screenshot I moved back to have the initial state. During testing rules were on and openVPN off.

Give me a few minutes, will set it up and show the log files.

[pooperman]

@stephenw10

Rules are enabled
🔒 Log in to view

that is the page from LAN view
🔒 Log in to view

that is the log
🔒 Log in to view

I know there is a different view for logs, which can be copied, but i cant find it.

[stephenw10]

If you enable logging on those pass rules on those pass rules then traffic that is matched and passed will be shown in the firewall log.

However you can see from the state counters there that nothing had been passed by them when that screenshot was taken.

It looks like no traffic is arriving on the WAN for ports 80 or 443. Check the ISP router is actually passing it.

Steve

[pooperman]

@stephenw10
i am very sure it is not related to ISP router, as port 443 for openvpn never had any issues.

however, i put it into DMZ mode, so there is absolutely nothing what might block it.

still no sucess.

[pooperman]

@stephenw10
when I use anschreikurse.duckdns.org from phone I get a warning for certificate is untrusted. I checked the cert and it is the root CA from pfSense.

If I click yes continue unsafe, it shows me loginpage of pfsense.

So that shows me, isp router is working fine and dns resulution is also working

[stephenw10]

I assume that screenshot was taken before you had tested that then as there are no connections shown.

Ok, you will need to change the port the pfSense GUI is listening on in Sys > Adv > Admin Access. You cannot have nginx and HAProxy both listening on 443.
HAProxy will logged that. It would have failed to start the frontend on 443.

Steve

[pooperman]

@stephenw10
good point!

i havent seen any notification but yes makes sense. so pfsense login is now on different port.

I came to the setting nat reflection mode for port forwards under admin advanced

it is set to disabled. is that correct?

[stephenw10]

That's the default setting. You do not need NAT reflection here at all, HAProxy proxies the traffic is does not forward it.

Steve

[pooperman]

@stephenw10

ok got it.

now I get 503 service unavailable

[stephenw10]

With the correct certificate?

[pooperman]

@stephenw10

I think so

🔒 Log in to view
cert is for anschreikurse.duckdns.org

haproxy frontend is also for anschreikurse.duckdns.org
backend is nc.anschreikurse.duckdns.org

[pooperman]

@pooperman

there is some issue with SSL handshake:

🔒 Log in to view