Moved pfSense to new hardware
-
Hello Everyone,
My old pfsense hardware died and I had to move my configuration to new hardware. All was going well until my web server again trying to connect to the outside world.After importing my old config I had to update my interfaces and some ips. I reconfigured my switch with new VLANs as I forgot my old ones as I had removed the cables from my switch without labelling them.
Anyone I managed to get everthing working except my web server. Now I thought this would have been automatic due to all config and some small adjustments but no. All my other VLANs connect to the Internet fine just not that one. Also even though I have setup NAT forwarding rules it still seems like everything is still being blocked?
Not sure if I have missed something due to importing an old config? All other divices connected to to switch work and have Internet access. Just my web server is not resolving or receiving any incoming connections!
Any thoughts on maybe something I have missed would be much appreciated.
Thanks
Rockyuk
-
@Rockyuk your question is inbound not working?
Usually that is the gateway on the device, or software firewall on the device. Or subnet mask.
-
Correct, inbound is not working via NAT forwarding to the Web Server. I have a MESH network, CCTV also connected which work fine. I had to change the hardware on the WAN to match the new computer pfsense is installed on. It seems like no dns is being resolved or inbound on the Web Server.
@SteveITS said in Moved pfSense to new hardware:
@Rockyuk you question is inbound not working?
Usually that is the gateway on the device, or software firewall on the device. Or subnet mask.
-
Where are you testing it from? You will need NAT-reflection or split-DNS to access it from some internal subnet.
Can the webserver connect out OK?
Steve
-
@stephenw10 I think it was an issue with my old switch and VLANs. The issue I have now is the DHCP on the VLANs is not working, which is causing the issues as the server as it is on a different network address.
-
If it's enabled on the VLAN interfaces in pfSense there isn't anything else required. It has to be some issue with the VLAN config if pfSense never sees the DHCP request broadcasts.
-
@stephenw10 I just purchased a new switch TP-Link TL-SG605E I have tagged the link port to pfsense server and untagged the port to device. I have done the same on all 3 ports 2, 3 and 4. All ports are picking up the default lan dhcp IP's and not the individual VLAN ones. Any ideas?
-
Does it have a separate setting for the PVID on each port?
Did you remove those ports from the default VLAN?
-
-
Yeah you need to set the PVID on those ports to tag the traffic coming into them onto the correct VLAN. So PVID 20 on port 2 etc.
And I would also remove ports 2,3 & 4 from the default vlan otherwise hosts there will see broadcasts from that.
-
@stephenw10 Grrrrrrrr, that is so frustrating something as simple as that I missed and worked first time
Thank you very much -
Yeah seems as though switch manufacturers present those settings in different ways just catch you out.
-
@stephenw10 I have one more question, I am unable to view my websites on my server locally again. I had the issue when I first started using pfsense. I have split-dns setup and NAT reflection but it is still not working. I have VLAN's but that should not make a difference as I had it working on my previous hardware with the same config? Any idea's?
-
If you have split DNS and it's working correctly, the hosts resolve as internal IPs, then you should only need firewall rules to allow it.
The server could potentially refuse access from that source.
The server may attempt to use some other route if it's multihomed in both subnets.
How does it fail? What errors do you see? Do you see blocked traffic in the firewall log?
-
@stephenw10 In the browser all I get is ERR_NAME_NOT_RESOLVED I can't see any blocks in the firewall logs etc
-
Screenshot 1
Screenshot 2
-
Can you re-upload those screenshots. There was an issue with pictures on the forum that is now fixed.
What happens if you just try to resolve the host from the command line on the test device? What error do you see?
-
screenshot 1
Screenshot 2
The other weird thing is the control panel for the server works locally & remotely and I can access that. But I cannot access the other three domains which is bizarre!
-
@stephenw10 I just did a nslookup for my laptop and got the following
Server: 127.0.0.53
Address: 127.0.0.53#53** server can't find mydomain.com: SERVFAIL
-
Ok, seems like it's not using Unbound in pfSense for DNS then. Do thet resolve to the internal addresses from Diag > DNS Lookup?
Though if it's using some external DNS server I'd expect it to resolve to the pfSense public IP.
