Nat stop working after certificate renewal
-
Hi,
I have some NAT rules that worked for a very long time, two days ago I clicked the notification to renew the certificate (web configurator)
I clicked renew, and got a new one,
Now none of my NAT HTTPS rules are working
The logs show that the default IP4 rule blocks the access
The rules are specific client IP to specific port go to specific local IP , same port - and I have like 5 rules like thatI do not know for sure its related to the certificate update but that's the last thing I did before it stop working
I tried reset states, did not helpthe error I get with the browser is access denied - tried multiple browsers, desktops, mobile, from multiple houses (users), including in incognito mode)
Any idea what to do ?
-
When you renew the web configurator certificate, the only thing that changes on your pfSense is this certificate file.
Here :
because the web configuration certificate can use this certificate, the first action is : restart the web server that hosts the pfSense GUI = web configurator so from then on the new certificate will be used by this web server.
All this has no impact on firewall - and NAT rules.
See here : Troubleshooting NAT Port Forwards.
-
@nirmelamoud said in Nat stop working after certificate renewal:
The rules are specific client IP to specific port go to specific local IP , same port - and I have like 5 rules like that
Maybe show them but it is highly unlikely that this is related unless the certificate was also used somehow elsewhere?
-
@nirmelamoud Yeah, unless it's not only NAT but perhaps a HA Proxy reverse HTTPS config you are running, then certificate renewal will have no impact on access through the firewall.
-
HA Proxy ? Other web servers using the same certificate (@Bob.Dig ) ?
Normally (in my world, that is), certificates are renewed way before they expire.
So the system worked before renewal. If something went wrong, and the GUI died because the new certificate was 'invalid/broken/other problem' the the GUI would fail to start up. But the loss of the pfSense GUI will not stop NAT rules from working.edit : True, a lot of info is missing ....
-
@Gertjan said in Nat stop working after certificate renewal:
HA Proxy ? Other web servers using the same certificate (@Bob.Dig ) ?
Yeah, if the OP is running HA reverse proxy on his pfSense using the WebUI certificate for HTTPS reverse proxying, then HA proxy needs to have the new certificate selected for reverse HTTPS publishing.
-
@nirmelamoud said in Nat stop working after certificate renewal:
the error I get with the browser is access denied
The logs show that the default IP4 rule blocks the accessIf the firewall blocked your access - your browser wouldn't show an error, it would just time out.
Can you post up the error page your seeing in the browser. As mentioned if something wrong with cert and you were using haproxy, its possible that could give you some sort of browser error back.
But if the firewall did not forward your traffic, and denied it in the logs then your browser would never haved talked to the webserver your forwarding too - so there would be no error in your browser other than hey couldn't talk to that. It would not be an access denied message if the client never actually talked to your webserver.
Are you using HA Proxy as reverse to your stuff behind pfsense? If so - why would it be using the web gui cert? Are you using ACME wild card cert or something? But that you mention web configuration for the certificate - that seems to indicate just the self signed web gui cert, which really wouldn't make a lot of sense to use in reverse proxy.
-
@Bob.Dig no haproxy
-
The client's browser has a white page with nothing but "access denied."
The system log shows" Aug 21 19:21:40 WAN Default deny rule IPv4 (1000000103)"but I do have a NAT rule that was working few days ago, for specific IP addresses, to allow them in
all of them stop working (without client IP change)Im not sure the certificate is related of course, but that's the only change I made, right before it stopped working
The router UI is workingI use direct DNS rules in CloudFlare (so the port will work as its not a standard port) but its not related to CloudFlare as even if the browser go to my direct IP , I see the same behavior
any idea how I Can debug this , find why the rules been passed through ?
the rule is basically single host - specific IP, from to port (both other -- both 8200) redirect to internal IP, same other port 8200
nat reflection - default -
@nirmelamoud said in Nat stop working after certificate renewal:
The client's browser has a white page with nothing but "access denied."
That is not what would happen with a firewall block.. Even with a redirection.
So here are the 2 different blocks - a just block, ie firewall just ignores the traffic.
And then here is a actual reject where the firewall sends a response saying hey you can't get there..
For browser to say access denied, the only way it should really know that is if the webserver trying to talk said hey buddy sorry your not allowed, which would be a 403 error.
So not exactly sure what is going on, but would follow standard port forwarding troubleshooting..
Here is how chrome shows it
What browser are you using? But a access denied would come from the webserver or a proxy, not a firewall even with a reject.
Are you forwarding this traffic to some internal proxy you are running?
-
@johnpoz THANKS for the detailed respone,
my rounter fw it to another router that fw it to a web server
I do not see the traffic in the internal router
I see the rule on the external router that say it block the traffic , so I do not think it passed the fw
agree I do not understand why I see access deniedI used edge and chrome (on windows, and chrome on android phone)
I do have pfblockgerNG on, but dont think its involved, it is blocking mainly other countries
-
@nirmelamoud said in Nat stop working after certificate renewal:
I see the rule on the external router that say it block the traffic , so I do not think it passed the fw
pfSense is the internal router or the external ?
