Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Web GUI and Load Balancer Conflict

    webGUI
    2
    2
    1.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      darkpixel
      last edited by

      I have two routers with their WAN interfaces in a /28.

      They share a handful of CARP IPs for redundancy.

      Let's just call them:
      1. - Router 1
      .2 - Router 2
      .3 - CARP WAN
      .4 - CARP Exchange

      Up until last night, we had any 443/HTTPS traffic coming in to the Exchange CARP getting NATted in to our single exchange server.

      Last night, the Windows guys announced the exchange cluster was ready and that the firewall should load balance the connections between three internal exchange servers.

      I deleted the NAT forward from CARP Exchange.

      In the Load Balancer setup, I added a pool called 'exch' in Load Balance mode, and set the port to 443.  I added the three exchange IPs to the list of enabled servers.

      In 'Virtual Servers', I set the IP Address to be the IP of CARP Exchange, and the port to 443.

      I went into the firewall and allowed inbound 443 to the CARP Exchange IP.

      From outside the network I would try to connect and eventually get a timeout.

      The moment I restart the Load Balancing service, I immediately get a connection, but it's to the pfSense GUI and I get warned about a potential DNS rebinding attack.

      Is the only way to use the load balancer on port 443 to change the pfSense GUI to a different port?

      Is there a way to bind the GUI to a particular set of IP addresses (like .1 and .2 on the WAN interface as well as the IPs on the LAN interface)?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        Move the GUI to another port.

        You can't selectively bind the pfSense GUI to specific IPs (yet).

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.