Need some routing assistance with pfSense, DMZ and WebSite
-
Hello,
Find below my setup:
Internet <--> Router 192.168.95.0/24 <--> pfSense <--> LAN 192.168.77.0/24
And a DMZ 192.168.200.0/24 on the other Interface of the pfSense (OPT1), that can access to internet but not the LAN.
Webserver is in the DMZ.My problem seems to be basic. Indeed, rrom the LAN I can connect to my website with IP adress but from the WAN I coudn't reach my website.
I try to do with public adress and with domain name. In both case, coonection faied !Firwall configuration seems to be correct !
Could you help me to solve my problem.
Many thanks in advance.
Best regards
-
@ILO_EWS said in Need some routing assistance with pfSense, DMZ and WebSite:
but from the WAN I coudn't reach my website
From some external public IP address? Or from a client in the pfSense WAN subnet directly?
Your upstream router is forwarding the traffic to pfSense?
Steve
-
@stephenw10 Yes the problem is from some external public IP address.
Outside my company, when I try to connect to my website (https://www.mydomain.com), the browser said that the page couldn't be load.
But is I try to ping mydomain.com or my public IP address, this works well.
Thanks for helping.
Best regards -
Ok so that's resolving to the external public IP on the upstream router?
Is that router configured to forward the traffic to pfSense?
Is pfSense configured to forward it to the webserver?
Check the state table in Diag > States. Do you see the incoming traffic forwarded as expected?
-
@stephenw10
Find below rules for WAN interface.
My web server is included inside DMZ network.
Thanks for helping.
Bet regards.
-
Ok, I assume you have the port forward rule too?
Check the state table when you're trying to connect. You should see states on WAN and DMZ if that traffic is arriving.
-
Get rid of your first rule.
- It's a very bad rule - no ... worse, as you've created your own nasty side effect :
- Traffic that would normally hit your second firewall rule, the one that open up TCP traffic with destination port 443 and 806 to you 'DMZ web server', is already 'captured' by the first rule ... that sends it 'no where'.
-
@Gertjan said in Need some routing assistance with pfSense, DMZ and WebSite:
Get rid of your first rule.
It's a very bad rule - no ... worse, as you've created your own nasty side effect :
Traffic that would normally hit your second firewall rule, the one that open up TCP traffic with destination port 443 and 806 to you 'DMZ web server', is already 'captured' by the first rule ... that sends it 'no where'.Even if I only the 2nd and 3rd rules is active, the problem is the same.
When I try to reach my website the error is ERR_CONNECTION_RESET.Best regards
-
Still my advise is to check the state table in Diag > States whilst trying to connect.
That will show you if the traffic even arrives at pfSense and if it does then if it's forwarded correctly.
-
@stephenw10 said in Need some routing assistance with pfSense, DMZ and WebSite:
Still my advise is to check the state table in Diag > States whilst trying to connect.
The traffic seems to arrive correctly. The web server has IP 192.168.200.2 (DMZ IP).
As the pfsense is connected to my ISP router, all traffic from 443 are redirected to port 443 on PfSense IP. Is it good ?
Many thanks in advance.
-
OK that's all outbound traffic from the server in the DMZ.
Set interfaces to
Allthere.Add
192.168.200.2to the Filter field and then check for states whilst you're trying to connect externally.You should see states on WAN and DMZ for that incoming traffic.
-
@stephenw10 Find below traffic.
Is it possible to have the same view with dateTime ?
I don't know if it's important but my web site use php technology.
Best regards
-
Ok that shows NAT works outbound but those are still all outbound states.
Were you testing from some external device at the time? If so it looks like incoming traffic is not being passed to pfSense.
-
@stephenw10 Find below traffic.
Is it possible to have the same view with dateTime ?
I don't know if it's important but my web site use php technology.
Best regards
-
Ok, try this: Filter by the external IP address you are testing from instead. You should see that traffic open states inbound.
-
@ILO_EWS this tells me your behind a double nat
Your lan traffic going out the wan was natted to a 192.168.95.239 address, your wan IP.. So if you want to forward something from out on the internet to something behind pfsense you would first have to forward on whats in front of pfsense to pfsense wan IP.
From your own statement, your clearly behind a double nat
Internet <--> Router 192.168.95.0/24 <--> pfSense <--> LAN 192.168.77.0/24
On that router that is connected to the internet, you need to forward whatever traffic you want to get to something behind pfsense to pfsense wan, from your state table that would be the 192.168.95.239 IP.
Then on pfsense you forward to what is behind pfsense. But until you forward on your router - pfsense isn't ever going to see anything to forward.
-
@ILO_EWS said in Need some routing assistance with pfSense, DMZ and WebSite:
As the pfsense is connected to my ISP router, all traffic from 443 are redirected to port 443 on PfSense IP.
As long as that's true it should work.
-
@stephenw10 if that was true then he would see that traffic hit his pfsense wan, be it he had any ports working or not via sniff.
-
@johnpoz
So in this case, do you think that the problem is on the configuration of my ISP routeur ?
Best regards -
@ILO_EWS go to like can you see me . org and send some traffic to 443 while you're doing a packet capture on pfsense for your wan IP and port 443 do you see anything with destination of pfsense IP to 443..
if pfsense doesn't see inbound to its 443 then no it can not forward anything.. Also that any any rule isn't right.. When you create your port forward it should auto create your wan firewall rule to allow 443 to your host your forwarding to IP.
