Port forwarding to Docker server

[dridhas]

Hello,

Recently got pfsense running and the only thing im missing is to configure the access to my docker server using my subdomains.
if i enter my external ip address i get the pfsense web gui.
This is what i have for the port forwarding rule:
login-to-view

and with this i get a certificate error which i can tell its the selfcert from pfsense.

now, within docker i have Nginx proxy manager that handles the accesses to the different containers via their own subdomain.
with the ISP modem it was just Modem > port 443 to 4443 > container.

the LAN firewall rule has no blocks.

would you be able to guide me on being able to reach the nginx proxy manager using
port forwarding?

Thanks in advance!

[viragomann]

@dridhas said in Port forwarding to Docker server:

if i enter my external ip address i get the pfsense web gui

Set the web configurator to listen on any other port in the advanced settings > admin page.

[dridhas]

@viragomann ok, webconfigurator's port has been updated to something else.
now when i enter the external ip, nothing happens which is good...

next step is to be able to enter my subdomain to reach the container server

[johnpoz]

@dridhas said in Port forwarding to Docker server:

next step is to be able to enter my subdomain to reach the container server

You really need to test this from outside your network... If your trying to hit your wan IP from something internal, you would need to do split dns to resolve to the local IP or you would need to setup nat reflection.

https://docs.netgate.com/pfsense/en/latest/recipes/port-forwards-from-local-networks.html

[viragomann]

@dridhas
And the source in the port forwarding should be "any".

[dridhas]

@johnpoz im testing this outside my home network (cellphone on LTE)

[johnpoz]

@dridhas as @viragomann mentions - this is wrong

login-to-view

While it doesn't actually have to be "any" it sure can not be your wan address. Would your phone coming from your LTE connection be using your wan address ;) heheh as its IP..

I have many of my port forwards locked down to certain source IP ranges, my son's IP for example for one. I use pfblocker alias to limit to say US IPs for other, etc. But yeah wan address as source is never going to work ;)

[dridhas]

@johnpoz i updated the PortForwarding rule to this:
login-to-view
and now im getting a 502 Bad gateway.
which i would say its an improvement...

[viragomann]

@dridhas
The destination has to be "WAN address". This is the IP you are accessing from outside. Only the source cannot be WAN address.

[dridhas]

@viragomann got that updated and still cant access the server from outside...

[viragomann]

@dridhas
And what do you get now?

Is there any state or traffic shown at the associated rule in Firewall > Rules > WAN?

[dridhas]

@viragomann this is what ive got:

login-to-view

[viragomann]

@dridhas
So it shows some traffic already.

Are the gateway settings correct on the destination device?

To investigate take a packet capture (in Diagnostic menu) on the internal interface facing to the destination device. Specify the port 4443 for filtering. Start the capture and try an access from outside.

If you network settings are correct you should see request and response packets. Post what you get, please.

[dridhas]

@viragomann i dont see any packets being captured, it shows blank login-to-view

[viragomann]

@dridhas
Dude, you NAT rule is wrong again!
The source port has to be "any", as well as the source IP!
The destination is "WAN address", destination port "443"!
At redirect target port you can enter your internal destination port, which might be 4443.

[johnpoz]

@dridhas Here is example port forward to different port external to what the port this is sent to the server port.. With the associated firewall rule.

Just where mine is locked down to a specific pfblocker alias - yours should be any.

login-to-view

[dridhas]

@johnpoz @viragomann sooooo... i got frustrated and decided to nuke pfsense and start fresh.
now, a few minutes after and following the advice provided above, i got able to do the port forwarding successfully.

i can now access my docker server from outside my network.

now its turn for the internal access, but first, i need to reconfigure the wifi...

this is how the WAN rules look so far:
login-to-view

and as you can see, there is more traffic now flowing thru.

[johnpoz]

@dridhas said in Port forwarding to Docker server:

now its turn for the internal access

huh? Why would you do that?

[dridhas]

@johnpoz i started the pfsense project a couple of days ago when i upgraded the home network, i didnt have much configs to worry about.
now that i have this setup and running correctly, i can create a backup just in the event i need to nuke it once again...

[dridhas]

@johnpoz so, after a hiccup, somehow i forgot to assign static dhcp address to the server and the access to docker server stopped working.
Once the DHCP static ip was set, everything went back to normal..