Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Big issues running IIS behind PFSense.

    General pfSense Questions
    8
    30
    15730
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pseudonym last edited by

      Well.. hopefully someone here can help me.  So far I have had absolutly no luck running websites behind PFSense.  I have an IIS 6 server running on windows 2008 Server with several webpages on it.  I have a forward set up for HTTP and I have rules set to pass traffic.  When set up on a stupid POS router, it works fine; however, when I try it with PFSense, I get a "Page Can't be Displayed" error message.  When I disable the Packet Filter it DUMPS ME IN AT THE INTERAL INTERFACE OF THE ROUTER!!!!  To say this is a BAD thing is a understatment of a massive nature.  There is no way I should be able to log into the internal interface of my router externally!

      No idea what is happening here.  Like I said, forward the port make sure the rule is correct and it works fine with ye ol' linksys router.  Exact same setup on PFSense and it goes to the internal interface when trying to access externally.

      Any ideas?

      Thanks

      ~m

      1 Reply Last reply Reply Quote 0
      • GruensFroeschli
        GruensFroeschli last edited by

        Please show a screenshot of all your rules you created.

        1 Reply Last reply Reply Quote 0
        • P
          pseudonym last edited by

          You mean the two =P.  One for MS-RDP and one for HTTP.. that is it.

          This is a very clean install.  Don't want to complicate things.

          UPDATE: Tred with NAT Reflection turned off and turned on with no results.  I am currently at an external location where I can access the server using RDP and access the internal interface of the router through that server.  RDP port forward works without any issues at all.. This is gonna make me bald and grey =P.  When rules are enabled I am getting a 404 error, with them disabled, I get directed to the internal interface of the router.  Not sure how PFSense handles host header names, thinking there might be a problem there.  Websites are registered in DNS just fine and.. as I said, everything works perfectly when behind a Linksys home router..




          1 Reply Last reply Reply Quote 0
          • W
            wallabybob last edited by

            A difference between RDP and HTTP (or HTTPS) is that pfSense will generally take no interest in RDP (unless you have a specific firewall rule for it) whereas pfSense has its own web GUI which can take a interest in  HTTP or HTTPS.

            How about configuring in System -> General Setup a non standard port for the pfSense WEB GUI and see what difference that makes? (For example, put the pfSense web GUI on port 89, and see if your web access from the internet to port 80 behaves any differently.)

            It might be relevant to know what is between the Linksys router and the internet (e.g. a cable modem or xDSL modem), what port forwarding magic is invoked there, whether the pfSense box reuses the Linksys's IP addresses or has a different set etc.

            Even though your rules might be simple, its a pity you didn't post them. Small details can make a significant difference and looking them up and posting them might have resulted in you or a reader seeing a "small" error (like interchanging two digits in an IP address) that had previously escaped your notice.

            1 Reply Last reply Reply Quote 0
            • S
              Supermule Banned last edited by

              Start by disabling the 2 rules infront of HTTP on WAN….

              Move a block all rule down below RDP rule.

              See if its better.

              1 Reply Last reply Reply Quote 0
              • D
                danswartz last edited by

                this all makes no sense.  i am running a web server on port 80 and port 443 behind a 1.2.3 pfsense with http and https forwarded and it works just fine!  Can you do 'pfctl -s nat | grep http' and 'pfctl -s rules | grep http' in a shell and post the output?

                1 Reply Last reply Reply Quote 0
                • W
                  wallabybob last edited by

                  pseudonym, sorry I didn't notice your rule postings.

                  danswartz: what port are you using for pfSense WEB gui? The pfSense book says (bottom of page 59) "Moving the WebGUI to an alternate port is also a good tactic for increased security, and it will free up the standard web ports for use with port forwards or other … " which doesn't exactly say its not possible to do port forwarding on the standard web ports if they are in use by the web GUI but does at least hint it might be a troublesome configuration.

                  1 Reply Last reply Reply Quote 0
                  • P
                    pseudonym last edited by

                    Thanks for all the replies.  I switched off the Web GUI to a non-standard port, but that doesn't seem to help other than I get a 404 error when the rules are disabled rather than it dumping me on the internal interface.  Helps a bit with security, but doesn't fix the problem.  Here are the text based rules as generated by pfctl:

                    pfctl -s nat | grep http

                    rdr on sk1 inet proto tcp from any to 96.52.133.83 port = http -> 10.10.2.90
                    rdr on sk1 inet proto udp from any to 96.52.133.83 port = http -> 10.10.2.90
                    rdr on sk0 inet proto tcp from any to 96.52.133.83 port = http -> 127.0.0.1 port 19000
                    rdr on sk0 inet proto udp from any to 96.52.133.83 port = http -> 127.0.0.1 port 19001

                    pfctl -s rules | grep http

                    pass in quick on sk1 reply-to (sk1 96.52.132.1) inet proto tcp from any to 10.10.2.90 port = http flags S/SA keep state label "USER_RULE: NAT HTTP Port Forward to Web Server"
                    pass in quick on sk1 reply-to (sk1 96.52.132.1) inet proto udp from any to 10.10.2.90 port = http keep state label "USER_RULE: NAT HTTP Port Forward to Web Server"

                    I am really wondering what, exactly the two rdr on sk0 (IN_IF) to the loop back address are doing.. I am also a tad confused that the external IP in the "rules" is somehow different from the external IP listed in NAT…

                    Anyhow, hope someone has some ideas what is happening...

                    Is there a way to just edit the pf.conf and ditch the webconfig?

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschli
                      GruensFroeschli last edited by

                      What should the external address be?
                      It's the same as in the screenshot you just showed.
                      Could it be, that you're using VIPs and used the wrong IP for the mapping?

                      1 Reply Last reply Reply Quote 0
                      • D
                        danswartz last edited by

                        wallaby. i am using the standard HTTPS port.  Given the webgui is not listening on the WAN anyway, I never understood this concern - it certainly does not affect my config.

                        1 Reply Last reply Reply Quote 0
                        • D
                          danswartz last edited by

                          i don't know what the two loopback redirects are for, but they are on the lan, not the wan.  as far as the IP in the rules being different, this is because the rdr (which rewrites the WAN IP to the forwarded LAN IP) is done before the access check.  sounds like your config is all buggered up.  i would try reinstalling from scratch (and not restoring the config, type it in from scratch, since it looks small.)  no, bypassing the gui is not usual, if you don't want that, you should build your own openbsd firewall from scratch, it has nothing but the CLI…

                          1 Reply Last reply Reply Quote 0
                          • P
                            pseudonym last edited by

                            I shall try another reinstall.. This is already install 3.  This is a really un-good situation.  I have PFSense routers installed at schools all over the province, if this is an issue.. then I seriously have to consider removing them and going with a different solution…

                            major bummer =(.

                            Any other suggestions?

                            1 Reply Last reply Reply Quote 0
                            • D
                              danswartz last edited by

                              Well, I am mystified.  You are not installing packages or anything?  It's hard to believe this stuff is just happening out of left field :(

                              1 Reply Last reply Reply Quote 0
                              • W
                                wallabybob last edited by

                                @danswartz:

                                Well, I am mystified.  You are not installing packages or anything?  It's hard to believe this stuff is just happening out of left field :(

                                Could we be looking at the problem in the wrong way? Does "Page Can't be Displayed" indicate a problem connecting to the server? a problem downloading data from the server?

                                Comments so far seem to have concentrated on the possibility of failure to connect to the server. Is their some independent verification that is the problem? (Does the server log incoming connections?)

                                1 Reply Last reply Reply Quote 0
                                • P
                                  pseudonym last edited by

                                  Packets are not hitting the webserver at all when I have PFSense as as the router.  I am certain that the webserver is at least functional as it works fine when using a different router.

                                  I am going to try a full reinstall… completely base (This install should have already been pretty basic as I reset and reconfiged with only the two rules).  I will give it another go and report back with a full dmesg and rules listing.

                                  In the meantime.. is ANYONE running PFSense in front of a IIS server hosting multiple websites???  Does anyone know how PFsense handles Host Header Names?

                                  This can't be an issue that only I am having...

                                  1 Reply Last reply Reply Quote 0
                                  • GruensFroeschli
                                    GruensFroeschli last edited by

                                    @pseudonym:

                                    In the meantime.. is ANYONE running PFSense in front of a IIS server hosting multiple websites???  Does anyone know how PFsense handles Host Header Names?

                                    I'm not running IIS, but pfSense is completly ignoring anything related to host header names.
                                    It simply forwards the packets specified in the NAT rule.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned last edited by

                                      Do you mean multiple webservers with sites or just multiple sites on one webserver???

                                      PFSense doesnt have Layer7, but I do not have any problems forwarding all my port 80 traffic to an ISA Server who has Layer7.

                                      One webserver behind PFsense is absolutely no problem… I can do that for you in 5 minutes via an remote session. No problems...

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        pseudonym last edited by

                                        It is one webserver, Win2k8 running IIS 7.5.  It is hosting a couple websites (EX: Fintrycroft.ca, corporatesecurityconsulting.ca).

                                        Should be as easy as forwarding port 80 to the correct internal IP, but for some reason it isn't working….

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Supermule Banned last edited by

                                          And it is loading the interfaces and assign them correctly??

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            pseudonym last edited by

                                            Yup.  No other issues at all.  I don't have load balancing setup, the only thing that has been configured is a port forward for MS-RDP and HTTP and the associated rules which were generated automatically.  Both forwards are going to the same machine and the MS-RDP is working perfectly.  Interfaces are assigned correctly and are working.  NAT is working (I am behind the firewall writing this).  WebGUI is on a non-standard port and packets are NOT being forwarded to the webserver… no idea why =(.

                                            EDIT:  added dmesg from last reboot in a file.

                                            dmesg.txt

                                            1 Reply Last reply Reply Quote 0
                                            • A
                                              Affiliated last edited by

                                              I Managed it to setup an IIS behinde a pfsense, and have had no problems. On the IIS are 2 websites hosted and identified by their domain.

                                              But i have to say that iam not very familiar with Webservers and their headers and so on. It has been a while since this setup. I think it was 1.2.3-RC2 we used for this.

                                              Regards from Germany

                                              1 Reply Last reply Reply Quote 0
                                              • dotdash
                                                dotdash last edited by

                                                I've had Apache servers running virtual hosts behind pfSense for years. I doubt that you have uncovered an undiscovered problem with the software. These things can be frustrating, but you need to look at your setup carefully and methodically to see if perhaps you have made an error. Try re-configuring from scratch and note the steps you used. Pfsense configuration may be different than what you are used to from working with other firewalls.

                                                1 Reply Last reply Reply Quote 0
                                                • P
                                                  pseudonym last edited by

                                                  @Affiliated:

                                                  I Managed it to setup an IIS behinde a pfsense, and have had no problems. On the IIS are 2 websites hosted and identified by their domain.

                                                  But i have to say that iam not very familiar with Webservers and their headers and so on. It has been a while since this setup. I think it was 1.2.3-RC2 we used for this.

                                                  Regards from Germany

                                                  I am not a huge web-head myself.  That is pretty much exactly the same thing that I want to do.  Did you do anything at all other than forward port 80?

                                                  1 Reply Last reply Reply Quote 0
                                                  • R
                                                    rpsmith last edited by

                                                    I believe the 404 error you are getting is coming from your IIS server so I don't think you are having a firewall issue or you wouldn't be seeing a 404 error.

                                                    Roy…

                                                    http://www.404errorpages.com/

                                                    1 Reply Last reply Reply Quote 0
                                                    • W
                                                      wallabybob last edited by

                                                      @rpsmith:

                                                      I believe the 404 error you are getting is coming from your IIS server so I don't think you are having a firewall issue or you wouldn't be seeing a 404 error.

                                                      This doesn't fit with
                                                      @pseudonym:

                                                      Packets are not hitting the webserver at all when I have PFSense as as the router.

                                                      Are there (have there been?) two distinct problems?

                                                      1 Reply Last reply Reply Quote 0
                                                      • P
                                                        pseudonym last edited by

                                                        Double checked the IIS server.  Found that the bindings needed to be changed.  I can now surf, without any issue internally using the FQDN.. however, still getting a 404 when I try to access externally.

                                                        The 404 error is the reason that I suspected that the issue may be the way that PFSense handles Host Header Name info.. if it is just forwarding the request to the server, and somehow stripping the Host Header Name info so that it is requesting the default page of the site rather than the specific site…

                                                        As I said earlier.. if I swap out for a box standard Linksys router it works with no changes to the IIS server.. Again, just a single port forward to the server....

                                                        I am also seeing the packets pass in the logs (I logged the rule) and I am seeing it pass the traffic now.. There has to be some simple setting that I am missing here.

                                                        EDIT: Just for info.. I am NOT running RDNS on this site and DNS is handle entirely externally... Do I need to setup a DNS server internally??  If so.. why would it work without one with the linksys???  scratches head... hair falls out

                                                        1 Reply Last reply Reply Quote 0
                                                        • W
                                                          wallabybob last edited by

                                                          @pseudonym:

                                                          Double checked the IIS server.  Found that the bindings needed to be changed.  I can now surf, without any issue internally using the FQDN.. however, still getting a 404 when I try to access externally.

                                                          I don't know IIS but I would presume that a production web server would have some means of getting it to explain why it sends a 404 response. (Maybe change log settings and restart.)

                                                          EDIT: Just for info.. I am NOT running RDNS on this site and DNS is handle entirely externally… Do I need to setup a DNS server internally??  If so.. why would it work without one with the linksys???  scratches head... hair falls out

                                                          I don't get the relationship between DNS and a "Page not found" error. Please explain.

                                                          1 Reply Last reply Reply Quote 0
                                                          • GruensFroeschli
                                                            GruensFroeschli last edited by

                                                            The 404 error is the reason that I suspected that the issue may be the way that PFSense handles Host Header Name info.. if it is just forwarding the request to the server, and somehow stripping the Host Header Name info so that it is requesting the default page of the site rather than the specific site…

                                                            The pfSense doesnt handle anything at all.
                                                            It is completly clueless about what it is transfering.

                                                            One thing that could be something:
                                                            Under "system –> general setup" what did you set for the "Domain" field?
                                                            If the server gets it's IP dynamically (pseudo static) from the pfSense, then this part will be assigned to the DHCP clients as connection specific suffix

                                                            
                                                            Ethernet adapter Local Area Connection 3:
                                                            
                                                                    Connection-specific DNS Suffix  . : gruensfroeschli.mine.nu
                                                                    IP Address. . . . . . . . . . . . : 10.0.8.11
                                                                    Subnet Mask . . . . . . . . . . . : 255.255.255.0
                                                                    Default Gateway . . . . . . . . . : 10.0.8.1
                                                            
                                                            
                                                            1 Reply Last reply Reply Quote 0
                                                            • W
                                                              wallabybob last edited by

                                                              I don't know about IIS, but I have recollections from some months ago that if the local hostname changes it may be necessary to change the Apache configuration file in sympathy.

                                                              1 Reply Last reply Reply Quote 0
                                                              • P
                                                                pseudonym last edited by

                                                                Okay.. something has happened and it does appear to be an automagic type thing.  Don't know how but it is now working!  W00t!.. I think LOL!

                                                                Anyhow, thanks for all the help guys!  It is mucho appreciated!

                                                                1 Reply Last reply Reply Quote 0
                                                                • First post
                                                                  Last post

                                                                Products

                                                                • Platform Overview
                                                                • TNSR
                                                                • pfSense
                                                                • Appliances

                                                                Services

                                                                • Training
                                                                • Professional Services

                                                                Support

                                                                • Subscription Plans
                                                                • Contact Support
                                                                • Product Lifecycle
                                                                • Documentation

                                                                News

                                                                • Media Coverage
                                                                • Press
                                                                • Events

                                                                Resources

                                                                • Blog
                                                                • FAQ
                                                                • Find a Partner
                                                                • Resource Library
                                                                • Security Information

                                                                Company

                                                                • About Us
                                                                • Careers
                                                                • Partners
                                                                • Contact Us
                                                                • Legal
                                                                Our Mission

                                                                We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                                                                Subscribe to our Newsletter

                                                                Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                                                                © 2021 Rubicon Communications, LLC | Privacy Policy