Domain name of pfsense via Cloudflare
-
Hi, I need help with configuration.
So:-
I have public ip address and domain linked to my cloudflare.
-
behind pfsense server I have windows server with active directory and other things like website, game server and other things.
What I want? -
I want to have subdomain(something.example.com) in my pfsense server where dns record are created in cloudlfare(this won't work), but I can access with public address to the pfsense webconfigurator(I add rule only for port 443 to access from WAN). (photo1,photo2)
-
I want to know if this will work if e.g I want to configure pfsense from the internet with a configured certificate of Cloudlfare.
This is how I imagine it: (photo3)
A few dns records for example.
Thanks for any response. If you have some questions, ask them. :)
-
-
@scroll_dp I am not clear on what your asking for?
I have a domain in cloudflare, and there are records that point to my pfsense wan IP. This would be dns only record, and not proxy.
-
@johnpoz
ok, I will send questions, and we can get somewhere because my explanation is weird.
so:
This domain is for what? For my local network?
What DNS record do I need to create in Cloudflare to work. I can access pfsense webconfiguration with public IP but with domain(something.example.com) I can't. Are the DNS records correct? I used A and SRV records. -
@scroll_dp the record would be A record not a _SRV record
From your above post you have that pfsense A record as proxied. While that can work as well, there is more setup for that.
If you set that A record to dns only, and point it to your wan IP.. When you do a query for this fqdn do you get back your wan IP?
example
And yes that domain in pfsense settings is just local use, should default to home.arpa, I use local.lan current (haven't gotten around to changing it to new standard of home.arpa).. But no home.arpa or local.lan would not resolve on the public internet no matter what you do because .lan is not a valid tld, and home.arpa is special use for local domains only.
-
@johnpoz ok, I set only to dns. Yes I can get back wan ip.
-
@scroll_dp well there you go, you can now access what you want to access remotely - as long as the ports your wanting to access actually get to your wan IP, and you allow it or forward as you need.
As long as your isp or some device in front of pfsense is not blocking the traffic - what you do with the traffic once it hits your pfsense wan IP is up to you.. Allow it to pfsense, forward it to something behind pfsense.. Setup haproxy to reverse proxy it, this is handy if your using different fqdn and want to send to different IPs behind pfsense based on the fqdn being used, etc.
-
@johnpoz
I have problems with that, can you explain how and where do I forward e.g something.example.com to 192.168.0.8 ? -
@scroll_dp under firewall, nat, port forwards
https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html#port-forwards
Do you want to forward say otherthing.example.com to some other IP like 192.168.0.9?
-
@johnpoz port forwarding works, but with domain no,
yes I want forward "otherthing.example.com to some other IP like 192.168.0.9?"
-
@scroll_dp well if you want to for hostA.domain.tld to 192.168.0.8 and hostB.domain.tld to .9 on the same port, say https (443) then you would need to setup haproxy as reverse proxy.
But that rebind warning - that is when you forward to somewhere and get back a rfc1918 address.. Where are you testing your "port forward" from?
Or your trying to access say pfsense with a different name than its actual name.
For example if I hit that fqdn that points to my public IP from my internal network on the port pfsense is listening on 8443, I get rebind
To test port forwards - you really need to be external to your network, or you need to setup nat reflection.
-
@johnpoz
"well if you want to for hostA.domain.tld to 192.168.0.8 and hostB.domain.tld to .9 on the same port, say https (443) then you would need to setup haproxy as reverse proxy."
no, there will be different port,"Where are you testing your "port forward" from?"
on my mobile, where I am connected via mobile data"I think we can forget to get access from wan to pfsense. Now I don't think it will be good idea.
Only what I need is, get access to my apps, websites from internet. They have different ports.
-
@scroll_dp said in Domain name of pfsense via Cloudflare:
on my mobile, where I am connected via mobile data"
Well that error would show up if you hit the web gui, ie you didn't port forward.
If you want to use say 443 for your port forwards, then good idea to change the port pfsense gui listens on - for example mine is 8443
But your pfsense box name is pfsense.localdomain.tld that is in its general settings. If you hit it using say other.otherdomain.tld then yeah you would get that rebind warning.
If you want to hit your public IP with whatever.domain.tld out on the public internet on port xyz, and have that go to 192.168.0.8 behind pfsense - then you need to setup port forward for xyz.
-
@johnpoz
I have one game server on port 30000 and I can access via publicIP "publicIP:30000"
But I have problem with domain: if I want for example "something.example.com" I can't, I tried everything what I can, but nothing helped. -
@scroll_dp you would have to hit something.example.com:30000
Just using a fqdn isn't going to work for port 30000, unless you forwarded say 80 or 443 to 30000 on 192.168.0.8
And then used http: or https://something.example.com
Post up your port forward and your wan rules.
example: here I have a public port, that forwards to a different port on my 192.168.9.10, but the application specifically hits that public port on my wan IP.
-
@johnpoz Now I have a different problem, I want to use port 30000 or different in local network on ip 192.168.0.57, with this IP it's working, but when I put public IP not lan IP, it can't access. How can I set, that I can use public IP in lan network?
-
@scroll_dp said in Domain name of pfsense via Cloudflare:
How can I set, that I can use public IP in lan network?
huh??
So your trying to do minecraft, yeah I think that requires a SRV record..
BTW - I sure and the hell would not open up 445 or 3389 to the public internet!! That is SUPER BAD idea!!
edit: Let me stress that again - that is BAD, like in REALLY BAD idea!!
-
@johnpoz
I know.
When I understand everything around pfsense, I set up vpn for rdp(3389) and samba(445), later I stop using samba and start using only stfp, but I need to get in my brain how it all works :D.
Before when I had "home router" that routing public IP to lan network, so e.g I can acces MC server via public IP in lan network, but now I can't and srv a A record is correct, because I used them before pfsense server. -
@scroll_dp said in Domain name of pfsense via Cloudflare:
that routing public IP to lan network
That is a port forward.. You mean you want a "dmz host" like home routers allow you to do? You could do that with a 1:1 NAT - again BAD IDEA!!!
