Unifi Controller behind pfSense (port 8443 question)

FrankZappa

HI,
I was checking out Johnpoz's replies to this question on this thread. Re: Unifi Controller behind pfsense.

I have pfSense running latest 26.03.1. I am in the process of setting up a unifi controller and a plex server on a headless pc runnning Ubuntu. Thats all this PC will be used for. I have the unifi controller reference my DDNS FQDN (example.duckdns.org). However, when I try to access the unifi controller using my FQDN (https://example.duckdns.org:8443) I get a pfSense DNS rebind error. What am I doing wrong? Thanks

luckman212

Have you forwarded (NAT) all the necessary ports to the LAN IP of your Ubuntu server? There are a bunch of ports needed. Off the top of my head: 8443, 8080, 11443, 3478. see here for ubnt's docs for the complete list with descriptions.

Next: are you using pfSense's Unbound DNS resolver, or something else? You should set up a split-horizon DNS override for your-unifi.whatever.com so when you access it from the LAN it resolves and routes directly to the internal IP vs "hairpinning" from LAN->WAN->LAN.

If you're using Unbound, this is simple to do in the GUI by just adding a Host Override.

FrankZappa

@luckman212 Thanks Luckman212. Just curious; if both pfSense and Unifi Controller use port 8443 for the GUI, how would I de conflict that remotely i.e. if I type in https://your-unifi.whatever.com:8443, would it attempt to connect to the pfSense GUI or the Unifi GUI? Also, if I NAT 8443 to the Unifi controller, how then do I access the pfSense GUI?

johnpoz

@FrankZappa said in Unifi Controller behind pfSense (port 8443 question):

FQDN (https://example.duckdns.org:8443) I get a pfSense DNS rebind error.

what does that resolve to, an IP of pfsense - then yeah pfsense would throw a rebind error - it doesn't like to be accessed by a name it is not aware of.

You would setup the fqdn your wanting to access pfsense on in the alt hostname under advanced admin access.

As mentioned by @luckman212 split dns is normally the way you would solve accessing something with its local IP vs public IP where you have some public fqdn that points to your public IP.

Personally if your trying to port forward port X through pfsense to something behind it. I would make sure pfsense is not using that port on its own. You can change what port pfsense gui uses. You can also change the port the controller gui listens on.

https://help.ui.com/hc/en-us/articles/218506997-Required-Ports-Reference

with use of system.properties file. Personally I would just change pfsense gui - its easier to do.

FrankZappa

@johnpoz Thanks again Johnpoz

luckman212

@FrankZappa Agree with @johnpoz on this- don't run your pfSense on :8443, change it to another port. I use 4443. I'd also install the ACME package while you're at it so you can access your firewall without your browser barking at you every time.

And: don't expose the pfSense GUI port to the internet unless you want 10-100% of your CPU cycles devoted to fighting off foreign adversaries.

Messing with system.properties is fragile and will bite you one day (it did me and I consider myself somewhat of an armchair Unifi expert)

Gertjan

@FrankZappa said in Unifi Controller behind pfSense (port 8443 question):

when I try to access the unifi controller using my FQDN (https://example.duckdns.org:8443) I get a pfSense

Connect from where ?
Somewhere from the Internet ? Being far away from home ? Of from a device, connected to a pfSense LAN ?
( with the controller situated in the same LAN, or another ^pfSense LAN )

@FrankZappa said in Unifi Controller behind pfSense (port 8443 question):

use port 8443 for the GUI, how would I de conflict that remotely i.e. if I type in https://your-unifi.whatever.com:8443, would it attempt to connect to the pfSense GUI or the Unifi GUI? Also, if I NAT 8443 to the Unifi controller, how then do I access the pfSense GUI?

You don't want / shall not / do not access the pfSense from the WAN side.
So, no, you should not use (for example) https://example.duckdns.org:8443 and then see the pfSense login screen.
This doesn't mean it's possible. You can do it .... as you and only you are the one who decides what your pfSense does.
Keep in mind that exposing the pfSense GUI on the WAN interface (using the default port 443 or 8443 or whatever) is considered a huge security risk.
Joke aside : if security risks are not an issue for you, why even bother using pfSense ?

edit example : get popcorn and Get Your Firewall Management Interface Off the Internet Now ... happens a couple of days ago, and it can happens to everyone and everybody. The only real solution is : do not expose GUIs.

When you create a NAT rule that allows incoming (into the pfSense WAN interface) traffic on port '8443', it will get 'NATted' to an internal pfSense LAN network, for example 192.168.1.10 (your Unbuntu host with the Unifi software controller VM).
It's very well possible that the pfSense GUI web server also listens (it listens on all pfSense interfaces, and this includes WAN interfaces !) uses port 8443 also. A 'conflict' isn't possible, because the incoming 'TCP port 8443' traffic on WAN will get routed (NAtted) away to a LAN IP , so the pfSense web-server process never 'sees' this traffic.

When you connect from a device connected to a pfSense LAN to :
192.168.1.1 port 8843 => you will connect to the pfSense Web GUI.
192.168.1.10 port 8843 => you will will connect you to the controller GUI.

Normally, you only use one (1) WAN NAT firewall/NAT rule : this one :

so when I'm somewhere in the middle of the anywhere, but not @home, I connect to the WAN IP of my pfSense first (I use like you a host name like "example.duckdns.org" which always point to my WAN IP) with the OpenVPN app, it exists for PC, MAC, iPhone and androids and everything else.
When the OpenVPN (or wiregard or IPSEC or whatever VPN you prefer), your device can access the pfSense GUI, and every other device on the pfSense LANs.
This is the secure way of doing things.
Since covid, this was the way how habitants on planet earth from 'home' connect to their 'work'. This implies that this method has been tested a ++billion times. It works, and it's safe.

Again, I'm not saying you have to use this 'VPN' method. It's perfectly fine that you expose GUI and other LAN services on the Internet, but there are consequences.
You probably don't want to face these consequences.

edit : anyway, what @luckman212 said.

See it like this : experts don't do this.
Non-exports don't exist, they normally don't survive** their way of doing thing. They find out stuff the 'hard way'.

** not a live critical survive, but there is a moment they will understood 'why not' and they won't post/talk about it anymore. No one talks about private mega OOPses ^^

I'm pretty sure that the usage conditions of the Unify Java Controller software says somewhere : "never ever expose it's access on the Internet".

Btw : My pfSense GUI uses the default port 443. Never saw a reason to change it.

luckman212

@Gertjan said:

My pfSense GUI uses the default port 443. Never saw a reason to change it.

One common reason: if you run a proxy like nginx or traefik behind your pfSense, you'd normally need to forward 80/443 to it. Exception if you have multiple IPs on your WAN side (e.g. a /29) and run those on 2 different IPs.

FrankZappa

@Gertjan Thanks. Only way I would ever access pfSense remotely is via a VPN. GUI port is NOT exposed to internet. I was more puzzled on both GUI's using 8443. I will change my pfSense port to something else. Thanks everyone.