what do i need to setup to direct different domain names to IPs on my network

comet424

hi
i like to know what is it i need to setup to redirect a domain name to an ip address on my network
now i have done the port forward for port 80 to my webserver.. and my windows server you could setup websites "www.test.com" "www.test2.com" and so on and it would handle the domain name

but i trying to setup a rocketchat on my unraid server..

it uses ports 3000
but if you wanna use domain name its like http s ://rocketchat.myhouse.mine.nu
and the unraid is 192.168.0.3

but i not sure how to redirect it.. as it doesnt use a port number like rocketchat.myhouse.mine.nu:3000 and that doesnt seem to be working
for for my domain from dyndns i use myhouse.mine.nu to get to my house

but what do i need to setup in pfsense that when it sees "rocketchat.myhouse.mine.nu" goto 192.168.0.3

i kinda looked in DNS forwarder but that didnt seem to help with the host and domain override..

is there something else i need to do any help be great

thanks

viragomann

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

but what do i need to setup in pfsense that when it sees "rocketchat.myhouse.mine.nu" goto 192.168.0.3

HAProxy
Without a proxy which is working on layer 7 pfSense isn't capable to forward a specific domain name.

However, you can use your dynDNS service to resolve rocketchat.myhouse.mine.nu to you public IP and simply forward port 3000 to your internal rocketchat servers IP and use the hostname in conjunction with the port to access it from outside.

So if you have set up your server with SSL, you should be able to access it by https://192.168.0.3:3000 from inside your network and
https://rocketchat.myhouse.mine.nu:3000 from outside, assumed your browser does not refuse the cert.

comet424

@viragomann ok thanks ill try it.. do you know if pfsense will ever have that option... i did try the dyndns pointed to my house adding rocketchat.myhouse.mine.nu the 192.168.0.3:3000 works but doing IP Address:3000 doesnt work... i looked at my WAN firewalls settings its showing 0/0 for sending receving for port 3000 or 80 (for my webserver )... then i tried my websites i hosting.. and apparently they not working either... some reason my port forwarding isnt working but last time i checked my websites was a couple months ago.. so not sure why forwarding isnt working.. and no errors on the main page of pfsense so i not sure where to look why it stoppped forwarding.. or if another service is conflicting with it..

viragomann

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

do you know if pfsense will ever have that option...

As mentioned above, you have that option if you install the HAProxy package. HAProxy is capable to handle HTTP(S) requests and parse the host-headers to different internal webservers.
Without that, pfSense operates on layer 3, so you only can redirect IP adresses and ports.

Since you use a dynamic DNS service, I assume you have only one public IP. If you have layer 3 capabilities only, you can only direct one IP/port combination to only one server.
So if you run a webserver inside your network and forward port 80 and 443 from your public IP to it, there is no possibility to access an additional internal webserver on these ports from outside.
That's why without a Reverse Proxy you have to use an additional port like 3000 for accessing the Rocketchat.

comet424

@viragomann so i setup haproxy to
https://blog.devita.co/pfsense-to-proxy-traffic-for-websites-using-pfsense/#step2configurehaproxy
that article but not able to get it to work.. i set it up to also point to my webserver on my network
so it be 192.168.0.30 port 80 and it cant resolve www.example.com as the web address. i can ping my www.example.com and it pings the pfsense router but its not forwarding my requests.. i deleted the Port Forward 3000 and 80 to the specific IP address' but i something is blocking requests i guess
i tried checking the firewall logs but it doesnt even show port 80 or 3000 being asked for or checked etc
i just didnt do the certificates and as i not using SSL

is there a better step by step.. and possibly why my port forwarding has stopped forwarding it seems..

comet424

not sure if it helps
but my unraid with the rocketchat is behind my VPN not sure if that matters 192.168.0.3:3000
my webserver is set outside of my VPN on my WAN connection 192.168.0.30 and hosts 5 different website domain names www.test1.com www.test2.com etc as example.

cant access any 5 of the websites to work.. traffic seems to be blocked.. but internal access and internet seems to be working .. so im sure i got something misconfigured but i not sure where to look

viragomann

@comet424
Configuring HAProxy is a bit more complicated than a simple prot forwarding. With these view infos you give its not possible to say if you did it right.

Appart from the proxy settings, you have to consider, that HAProxy is a webserver and client. Si if you are running it, the proxy has to recieve requests from outside, send request to the backend webserver, recieve responses from them and send responses to the client.
This can only work, if you remove the portforwardings to the webservers and allow access to the pfSense itself on port 80 (+443 for HTTPS).

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

but my unraid with the rocketchat is behind my VPN not sure if that matters 192.168.0.3:3000
my webserver is set outside of my VPN on my WAN connection

What do you mean with "outside VPN" and "behind VPN"?
All internal servers may be behind pfSense. If you run VPN on it, they are behind VPN.

comet424

@viragomann ok sorry my dislexia it sounds good in my head but i dont explain it right at times for others to know..
1.. i mean with the HAproxy disabled or uninstalled.. Port forwarding seems to be broken anyways its not forwarding ports it used to Port Forward Por 80 to my Windows VM that handled 5 different Websites... but it no longer is working last time i check was 2 3 months ago so it worked then... so not sure what i done in the mean to or miss configured Port forwarding will not work.. i only realized there was a problem when i can do 192.168.0.3:3000 but cant do <ip address>:3000 it wont go through and i followed the instrutions in that link so dont have a better step by step.. ..

2.. what i mean is IP address 192.168.0.1- to 29 and 192.168.0.50 to 255 Fall behind NordVPN (Behind VPN) .... IP Address 192.168.0.30 to 49 Fall Behind (WAN Connection) aka Outside of the VPN (not behind the VPN)

i also tried the using my cell phone no wifi using my cell tower internet and it couldnt access it..

i also tried disabling haproxing left my Port forwarding (NAT/Rules) setup and i looked at my Forwarded WAN Rules when i tried to access my websites normally like i had.. and i get maybe 80 bytes after trying multiple times but System Logs show nothing behing accessed on port 80...

so i think somewhere in my setup i must have miss configured something... that has disabled the Port Forwarding and/or haproxy.... not sure where i even look... everything works i on my network it just seems port forwarding and the haproxy ports etc is blocked.... and im sure its probably a wrong Check box checked..

i just hoping i dont need to do a reset and start over lol...
would you happen to know if there is a way to see if pfsense finds any conflicts or tests likes a self diagnostic.. like Unraid there is option to find Common Fixs finds common mistakes you may have done by accident... doesn pfsense have something like that...

also like in unraid you can send a diagnostic file and others can look and see where you went wrong.. if i send the pfsense config file.. can you see what i have set wrong

sorry if i made my explaination worse, sounds ok in my head

viragomann

@comet424
Are you able to access your webservers from within your LAN?
If so, by the internal IP or by the hostname? If hostname, do you have split-DNS (DNS overrides) or do you use NAT reflection?

At first you have to get access to your servers to work from internal, then you can go about portforwarding or proxying.

The same applies to Rocketchat.
You say, you have it on 192.168.0.3:3000. That's the unraid IP as you mentioned. So do you have a port forwarding set up on unraid?

The VPN routing you mentioned only affects outbound traffic from the appropriate IPs.

It's not a good idea to post your config file on a public forum. It includes secrets. You may post screenshots of your settings pages and cutouts of your log files (/var/log/). Public IPs should be hidden.
On pfSense we use Packet Capture from the Diagnostic menu to investigate the traffic flow.

comet424

@viragomann
ill have to get back to you on all those some kinda confuse me.. im a visual learner not as much a reader.

but to try to answer your questions about my things
the Websites i have never been able to access all of them from the localhost just it always picked the first one
so my webserver is 192.168.0.30
now it runs windows server running IIS and i have
www.test.com
www.test2.com
www.test3.com
as examples..
so in the past i was able to Port Forward my 80 to the 192.168.0.30 and then Windows determined which website it works..
if i do on my local network 192.168.0.30 she will pick the first website running so that works
if i try <wan ip address>:80 doesnt connect
it used to work in the past but when i alter something i never thought of checking my webservers if still working.. so thats why maybe i checked off a box i shouldnt have reason why the port forwarding or the haproxy isnt working.. probably when i set up the vpn i not totaly sure..

with the 192.168.0.3:3000 yes works on the internal network goes right to the page... but doing <Wan ipaddress>:3000 doesnt work even through cell on a cell internet not the wifi

ah ok so pfsense doesnt offer like unraid a anonoymous diagnostic logs where it hides all the important data but exports data so other users can help you fix it.. but doesnt show any passwords etc..

so ill have to learn that packet capture.. etc.. i dont use the pfsense every day i use it because it had features i needed that my asus router didnt have.. so pfsense did what i needed.. so i not smart at it and i set it up and forget it.. not one that access's every day like all these professionals.. do like this program.. but sometimes its over my head at times least with a learning disiability and certain words i dont understand but then again i not working with this everyday

but enough of my issues you dont wanna hear..

what screen shots do you need to see that could be causing the port forwarding issues or the haproxy issue.. i googled and it linked me to
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html#:~:text=If%20problems%20are%20encountered%20while,%C2%AE%20software%2C%20try%20the%20following.&text=Always%20test%20port%20forwards%20from,NAT%20entry%20and%20enable%20logging.

i tried checking each one but some didnt apply and i think i checked them all and that didnt apply to fix my issues ..

but ya if you can tell me what screen shots you specificy need to see my mistakes.. so i can get things up and running again

and i appreciate you taking the time in helping me.. i very appreciative

comet424

@viragomann so i been fiddling no luck.. what screen shots would you need?
also i noticed i get an error if i type my www.example.com
i get error
503 Service Unavailable
No server is available to handle this request.

but if i type 192.168.0.30 (webserver) it works just fine picks off the first website in the list of 5... so is pfsense blocking it.. i tried to google it but i not finding what i need.. and still havent gotted the www.example.com:3000 to or the haproxy to work yet something is blocking it in here

comet424

@viragomann so here are some screen shots of my rules and nat
what other settings would you need to see to see whats wrong lan rules.PNG nat outbound.PNG ![nat portforward.PNG]( wan rules.PNG

comet424

i did a packet capture..
clicked Stop
enterd host 192.168.0.30 (webserver)
entered port 80

and click Start
tried going to my one website... and just got page cant be found really.. i stopped the capture
to view but shows up blank

viragomann

Still not clear, what you're trying to implement now, port forwarding or the haproxy? Please, declare at first.
There is no way to help if I don't know what you're trying to achieve.
If you can go with accessing the Rocketchat on port 3000 I'd do portforwarding, since it is easier to realize.

Also give some details about you network.
The LAN is 192.168.0.0/24?

comet424

Both...
sorry explaining wrong.. i gave up on HAproxy.. because i said Port Forwarding no longer works and asked whats setup wrong..
because i mentioned my VPN, outside of the VPN, i mention my Webservers no longer work. i mentioned trying to use the HAProxy i get 503 error..
but ill try again

1st i wanted port 3000 to work but like i mentioned Port Forwarding is broken.. I send you link of the like 13 steps to follow to fix Port Forwarding.. non help and most didnt apply to me.. so reason you said you need settings,, reason i sent the photos of my Rules and Nats to see where its set wrong..

2nd.. Port Forwarding is broken for Port 80 its like being blocked or so

3rd That Packet Capture doesn work shows up blank

4th
my network i mentioned above but is
192.168.0.1-30 (VPN)
192.168.0.31-49 (WAN)
192.168.0.50-255 (VPN)
192.168.10.x (Camera network) (not setup yet)
192.168.20.x (Guest Network) (n0t setup yet)

but overall like i mentioned from trying to get rocketchat to work.. Port Forwarding no longer works for Windows Server for Port 80 and i trying to get Port 80 to forward to 192.168.0.30....
i dont know what is blocking it

i have also changed in dhcp server
so 192.168.0.30 no longer uses the DNS servers of my vpn but just 192.168.0.1 for my Webserver
i removed the DHCP of everyone from my VPN servers to 192.168.0.3

but ya i trying to get the 5 webservers and Rocket chat to work and like i mentioned i only found out Webservers are not port forwarded because i couldnt get Rocket Chat to Port Forward.. as you see in the screen shots
Port Forward 80 goes to 192.168.0.30 and on the Same screen shot you see i have it setup Port Forward 3000 goes to 191.168.0.3.. And neither is work. Port forwarding is broken and i been googling past week trying to watch videos etc.. what is checked off/on that broke port forwarding.. or if because i have a VPN

so i just dont know where to look anymore i keep trying a setting see if it works or not..

Rocket Chat Works Local Network Not WAN
Webserver Works Local Network Not WAN

i mentioned i followed
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html#:~:text=If%20problems%20are%20encountered%20while,%C2%AE%20software%2C%20try%20the%20following.&text=Always%20test%20port%20forwards%20from,NAT%20entry%20and%20enable%20logging

and these did not help me.. reason i said i must have something configured wrong that is conflicting nd broke port forward

im gonna try later today a fresh clean install of pfsense setup the port forward 80 and 3000 and using fresh install to see if it works.. as i no longer know where to look so i hoping that will fix things

viragomann

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

Both...

You cannot do both.
If you want to run haproxy, you have to disable the portforwarding and set or edit your WAN rules to allow the access.

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

i mentioned trying to use the HAProxy i get 503 error..

No. You mentioned the error, but not that it happened with haproxy.

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

I send you link of the like 13 steps to follow to fix Port Forwarding..

?

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

2nd.. Port Forwarding is broken for Port 80 its like being blocked or so

So you may troubleshoot it or not?

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

3rd That Packet Capture doesn work shows up blank

Without an info to the interface the capture was taken that statement is useless.

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

but ya i trying to get the 5 webservers and Rocket chat to work and like i mentioned i only found out Webservers are not port forwarded because i couldnt get Rocket Chat to Port Forward.. as you see in the screen shots

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

but ya i trying to get the 5 webservers and Rocket chat to work and like i mentioned i only found out Webservers are not port forwarded because i couldnt get Rocket Chat to Port Forward.. as you see in the screen shots

Your screenshots don't show any portfrowarding.

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

Port Forward 80 goes to 192.168.0.30 and on the Same screen shot you see i have it setup Port Forward 3000 goes to 191.168.0.3.

These are firewall rules!

Portforwarding is done in Firewall > NAT > Port forward.

comet424

1.. some reason the the forum lost the picture.. Portforward was uploaded with OutBound NAT but ill add it to the end

when i said both.. I was stating i try to get both to work... i dont need to run both same time. but HAproxy is non functional. Port Forward is non functional is what i ment... i need the Port Forarding of Port 80 up and running my websites been down apparently months
.
the 503 error figured you knew was from the HAproxy.. as that error doesnt show up if you dont have haproxy setup.. figured you probably altready knew it.. as i trying to try all settings turning things on and off ...

4, you did the "?" for the 13 steps i said i did and i send you the link.. but its 15 steps. here it is again
https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html#:~:text=If%20problems%20are%20encountered%20while,%C2%AE%20software%2C%20try%20the%20following.&text=Always%20test%20port%20forwards%20from,NAT%20entry%20and%20enable%20logging

5,, yes i been trying to trouble Shoot Port 80 for a week since your last reply.. still no luck.. from a cell or remote computer can not Forward Port 80 for my webserver.. interal IP still works external doesnt.. i was able to get traffic to finally show up on the WAN firewall rule not sure what fix got it to do it.. but it still cant process the website.. I did get rocket chat to work 20 min ago kinda outside of the network.. it finally showed up saying Rocket chat.. but firefox keeps saying "gah tab crashed" so i not sure if its truly working or not....

Capture Pack.. not sure what you mean the info to the interface.. default is WAN i entered the IP and port but the START and STOP didnt record anything

here is the screen shot of Capture Packet and the NAT Forwarding that was uploaded other day

packet capture.PNG

packet capture2.PNG nat portforward.PNG

sorry if i lousy explainer.. sounds all clear when i write it..

viragomann

Ok, so let's go with port forwarding.
And try to troubleshoot one by one.
For your webserver you have a mistake in the port forwarding rule. The destination has to be WAN address.

You say, you are able to acces the webserver from internal network by simply entering 192.168.0.30 in a webbrowser. Does it also work from another subnet?

Is so try to access it from the internet by entering your WAN address into the browser.
If that doesn't work, take a packet capture on WAN and only filter the port 80. In the screenshot you have filtered for the internal IP, so it's normal that you don't see any packet.

comet424

ah ok . so change the LAN address to WAN Address? how come i thought i needed to port forward to LAN address of 192.168.0.30.. it used to be WAN orginally but since i been trying to trouble shoot and figure where things when wrong...

i have not tried another subnet.. only because Guestnetwork and Cameras is setup for future when i get guests and cameras
but i have a dedicated OpenVPN connection to my sisters house her ip is 192.168.1.x i setup
if i type in a FireFox on that network and type 192.168.0.30 websserver .. i get a 404 error.. doing 192.168.0.3:3000 gets me the rocketchat website on my network

if i try accessing my webserver address from my local network (192.168.0.x).. so www.example.com i get this error
"Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding
Try accessing the router by IP address instead of by hostname." keeps loading up the pfsense doesnt want to goto webserver

so hope that helps so far. in finding my mistakes

if i do www.example.com on my 192.168.1.x firefox i seem to get the website to work.. but not by IP address i also decided to reinstall a new VM of windows and post my websites on tehre so i only have 1 website out of my 5 setup.. just to test if maybe was my vm that failed.. as i dont know why things went wrong.. plus you never know right its windows always needs updating lol

viragomann

@comet424 said in what do i need to setup to direct different domain names to IPs on my network:

if i type in a FireFox on that network and type 192.168.0.30 websserver .. i get a 404 error.. doing 192.168.0.3:3000 gets me the rocketchat website on my network

So you know, both server are responing to access from outsider your LAN.

If you want to access your websites by their hostnames from within your network you should either

set up DNS overrides or
configure DNS reflection

DNS override is the more reliable solution. Assuming pfSense provides DNS in your network and you run DNS Resolver, go to the Resolver settings and add the needed overrides there.