Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Webserver SSL is not private (How to set)

    Scheduled Pinned Locked Moved General pfSense Questions
    31 Posts 6 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      SteveITS Galactic Empire @carrzkiss
      last edited by

      @carrzkiss Port forward seems like what you want. People do occasionally post here asking to forward port 443 to one server for example.com and another for example.net which doesn't work without something proxying that by hostname.

      If you forward directly to one web server IP instead of the load balancer does it work? If so, then it would be a load balancer issue.

      Check a packet capture and the states as noted above.

      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
      Upvote 👍 helpful posts!

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        If the load-balancer is at .46 and is proxying or forwarding traffic from there to other internal servers it should work. HAProxy would replace any existing load-balancer.

        You might be seeing some asymmetric routing depending on how the load-balancer is handling that traffic. I would expect to see some blocked traffic on LAN in the firewall log if that's the case though.

        You might also be seeing this: https://docs.netgate.com/pfsense/en/latest/install/upgrade-before-2.2.html#microsoft-load-balancing-open-mesh-traffic
        If the load-balancer is using a multicast MAC address you'd need to set that tunable.

        Steve

        C 1 Reply Last reply Reply Quote 1
        • C
          carrzkiss
          last edited by

          @steveits
          I just checked something.
          On one of the ARR Servers, I did a ping.
          Google - works
          Microsoft - Request Timed Out.

          So, it seems the servers are not getting into the world.
          And if they are not getting out, and nothing is coming in, that would explain why there is no connection.


          I also found in System / General
          DNS Server Settings.
          I am unsure if I did this right or not.
          I added in the DNS Server I run (WAN IP Address)
          Along with the 3-pointer DNS Servers that point records for us as well.
          But none of that seemed to change anything.

          1 Reply Last reply Reply Quote 0
          • C
            carrzkiss @stephenw10
            last edited by

            @stephenw10
            I am getting someplace now. Thank you.
            Adding the
            Tunable: net.link.ether.inet.allow_multicast
            Value: 1
            It was what was needed.

            I was able to pull the site up.
            The SSL is giving an error again. (the connection if not private)
            And I have to figure out how to get the SQL Server to work, but at least I am getting something.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Adding DNS servers there only does anything for queries from pfSense itself unless the resolver is in forwarding mode.

              Are those web servers using their own IPs to send pings or is everything going via the load-balancer IP?
              Definitely check that multicast MAC issue if it's the latter.

              Steve

              C 1 Reply Last reply Reply Quote 0
              • C
                carrzkiss @stephenw10
                last edited by

                @stephenw10
                All web servers go through the ARR Server(s), as that is the only IP Address I have listed for allowing passage through the Firewall. (Set up the same way I had it through the other Router.)

                -- Definitely check that multicast MAC issue if it's the latter.

                What exactly do I need to check in on this?

                C 1 Reply Last reply Reply Quote 0
                • C
                  carrzkiss @carrzkiss
                  last edited by

                  Update
                  Just did a check on https://www.yougetsignal.com/tools/open-ports/
                  And it shows that Port 80 and 443 are both OPEN.

                  The following areas had to be updated with the new Network information. (When you design something and leave it for a few years, you kind of forget about it)

                  Microsoft Failover Cluster for SQL Server
                  Two IP Addresses had to have their subnets changed over.
                  And that got the SQL Server running.

                  However, since getting that going, which got rid of the SQL Server error, I am once again faced with the

                  The site can't be reached.

                  I removed all the DNS IP Address entries I listed prior.
                  And rebooted PFSense.
                  And the sites are all still down.

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    carrzkiss @carrzkiss
                    last edited by

                    OK.
                    I can view my websites locally, which is great, using their domains.
                    port forwards from local networks

                    Still cannot view them outside of the firewall.
                    And I also am having an issue with the SSL certs.
                    It seems the ones created through PFSense are not going to work.
                    So, I will look at something else and see what I can learn about using the PFSense method to create Web Server IIS Certs.

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @carrzkiss
                      last edited by

                      @carrzkiss
                      Can you be more clear about the issue with the certs? Does it work from inside with https?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by stephenw10

                        So what error do you get when you try to connect now externally?

                        Do you see states in the firewall?

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          carrzkiss @stephenw10
                          last edited by

                          Everything is now LIVE.
                          When I was out, I decided to try the site(s) and see what I got while totally away from the office, and I got the site but with a non-working SSL. OK, Good.
                          So, when I got back to the office just a few minutes ago, I grabbed the SSL cert I had installed the other day before creating the SSL through PFSense, and everything is working.
                          All sites are LIVE in front and behind PFSense.

                          Thank you, everyone, for all the help.
                          Have to say this community absolutely ROCKS!!!!

                          All the information to get the site(s) live was from this thread here, with the link(s) provided and the link(s) I provided.
                          So, if anyone has this same issue, all you have to do is follow everything from start to here, and you should be good to go.

                          I've tried to notate everything I had to do, so I can write an article for our Knowledge Base site.
                          Love sharing and exchanging knowledge.

                          1 Reply Last reply Reply Quote 1
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.