Port forwarding issue

Blade1 · Dec 2, 2015, 8:08 PM

Hi,

I have a DMZ network setup. Within this, I have a server (192.168.33.15) hosting a website in IIS (test.domain.com).

I want to use port forwarding to forward requests for this domain from the firewall to the server (which is on a private IP) and return the results.

I have set the DNS servers of the web server and the firewall to a DMZ DNS server which has the relevant DNS records. However, when browsing to the site from an outside machine, I just get DNS could not be resolved.

I also have a firewall rule to allow traffic from WAN to this server.

What gives?

KOM · Dec 2, 2015, 8:09 PM

What about your NAT rule?

johnpoz · Dec 2, 2015, 8:12 PM

So is your test.domain.com resolve on the public internet to your public ip? Sounds like that isnt working

Blade1 · Dec 2, 2015, 8:12 PM

@KOM:

What about your NAT rule?

Could you elaborate, please? What would this look like?

Blade1 · Dec 2, 2015, 8:13 PM

@johnpoz:

So is your test.domain.com resolve on the public internet to your public ip? Sounds like that isnt working

Unfortunately not and I was/am a bit confused here… I guess I'd ask my domain name hoster to create a record here?

johnpoz · Dec 2, 2015, 8:17 PM

Yeah kind of hard for pfsense to forward traffic it never sees user outside pfsense has to be able to resovle test.domain to get to pfsense for pfsense to see traffic and forward it

KOM · Dec 2, 2015, 8:18 PM

Could you elaborate, please? What would this look like?

A NAT rule tells pfSense how to translation from public IP WAN request to private LAN host. In your case, you need a port forward so that pfSense know to forward certain traffic to the host on your LAN. To do a port forward, you need both a NAT rule to define the forwarding and a firewall rule to allow the traffic to flow. Sounds like you only have the firewall rule, if that.

https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

Blade1 · Dec 2, 2015, 8:45 PM

@KOM:

Could you elaborate, please? What would this look like?

A NAT rule tells pfSense how to translation from public IP WAN request to private LAN host. In your case, you need a port forward so that pfSense know to forward certain traffic to the host on your LAN. To do a port forward, you need both a NAT rule to define the forwarding and a firewall rule to allow the traffic to flow. Sounds like you only have the firewall rule, if that.

https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

Ok thanks.

That leaves two questions:

When setting up port forwarding, does it need to be done in tandem with reverse proxy (e.g. the squid reverse proxy which I have installed on the pfsense VM)
Do I need to make any changes to the domain name? I.E. the domain name is purchased with a registrar, do I need any records registered with them?

Thanks

KOM · Dec 2, 2015, 9:12 PM

When setting up port forwarding, does it need to be done in tandem with reverse proxy (e.g. the squid reverse proxy which I have installed on the pfsense VM)

I don't have any experience with squid reverse proxy so I can't advise you there, but I would tend to believe that if you have reverse proxy configured right, you shouldn't need a manual NAT rule? I don't know for sure.

Do I need to make any changes to the domain name? I.E. the domain name is purchased with a registrar, do I need any records registered with them?

The authoritative DNS for your domain should point back to your pfSense WAN IP address. Do you only have the one public IP address or more? If oyu have several public IPs and are using Virtual IPs to handle them, you would ensure that DNS for your domain points to the VIP you're using for that service.

doktornotor · Dec 2, 2015, 9:19 PM

@KOM:

I don't have any experience with squid reverse proxy so I can't advise you there, but I would tend to believe that if you have reverse proxy configured right, you shouldn't need a manual NAT rule? I don't know for sure.

You need allow rule on WAN for WAN IP/reverse proxy port. (N.B. This only can be meaningfully tested from WAN. Do NOT bother with "tests" from LAN via NAT reflection and similar clusterfucks.)

KOM · Dec 2, 2015, 9:22 PM

So you do need a firewall rule but not a NAT rule when using reverse proxy?

doktornotor · Dec 2, 2015, 9:23 PM

Yes. (Again, talking about valid tests from WAN.)

Blade1 · Dec 6, 2015, 2:07 AM

Ok so I've configured a DNS rule testsite.domain.com to go to my firewall's public IP address.

However, despite portforwarding setup, a firewall rule, and the reverse proxy, the web page is never hit?

I guess I should now ask in the Squid section.

johnpoz · Dec 6, 2015, 2:54 AM

so testsite.domain.com resolves on the public internet to your public IP??

doktornotor · Dec 6, 2015, 8:15 AM

@Blade1:

However, despite portforwarding setup, a firewall rule, and the reverse proxy, the web page is never hit?

What port forwarding?! You either use RP or port-forwarding. Not both! And let me tell it again - testing this from LAN is a complete waste of time.

Blade1 · Dec 6, 2015, 9:45 PM

I tested from an outside machine but failed.

Nonetheless, I redid everything but no port forwarding rules and I can access an internal web server!

The only problem is I get the error here when changing the default port for the reverse proxy:

https://forum.pfsense.org/index.php?topic=87280.0

So my internal web server is running on port 8082. testsite.domain.com redirects to the pfsense homepage but testsite.domain.com:8082 goes to the web server.

Can I make testsite.domain.com go to testsite.domain.com without the port number showing?