16

I am needing to access a local LEMP server through its domain name for a PHP package that uses domain names in every link, making IP address usage not possible for this application.

I can access the domain just fine from devices elsewhere on the www.

pfSense manages two physically separate networks, but accessing the server with the domain brings up the "Potential DNS Rebind attack detected" warning page when accessed from either network, however, using the IP address brings up the server's pages just fine.

The server has a static mapping configured with the domain name set in the configuration in Services DHCP Server.

I have the DNS Forwarder enabled and the Register DHCP static mappings in DNS forwarder is checked.

I am running pfSense 2.1.5.

What else do I need to do?

Improve this question
3
  • 1
    https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks
    – user15469
    Commented May 17, 2015 at 21:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 3, 2021 at 5:45
  • @RonMaupin I resolved the question for myself prior to an answer here. Over the years I have observed the pfSense devs to change the GUI such that configuring requires different steps even through previously configured devices do not require reconfiguration. Currently, it appears MarcoZen below is maintaining an answer, but over the years it is likely to become stale, or a new and better solution will be released.
    – Paul
    Commented Jul 11, 2021 at 14:55

4 Answers 4

Reset to default
20

Its been two years since the question was asked, but I had the same problem (domain name) and SOLVED it by:

  1. Log into pfsense via IP address or any working domain name
  2. Goto System -> Advanced -> Admin Access and under Alternate Hostnames - key in your new domain name. You can add extra domain names by separating them with spaces.
Improve this answer
2
  • Just as a point of note (because I just spent the last 20 minutes doing this wrong), the name of the field is a little bit misleading... "hostnames"... it will accept both a hostname AND an FQDN with a different domain than the native/defined domain. So, if the firewall internally is connected to multiple domains, you need to make entries for BOTH the hostname and FQDN. For example... define con-fw and fab-fw as well as con-fw.contoso.com and fab-fw.fabrikam.com
    – Craig
    Commented Sep 21, 2022 at 8:24
  • I believe the above answer is for accessing the pfsense GUI through another alternate hostname, and not for accessing other hosts in the internal network.
    – Elfalem
    Commented Sep 3 at 22:22
4

Go to System > Advanced, Firewall/NAT tab. then you need to enable three options:

1) Pure NAT for NAT Reflection mode for port forwards 2) Enable NAT Reflection for 1:1 NAT 3) Enable automatic outbound NAT for Reflection

Click Save.

It solved my issue and if it solves your issue, keep me in your prayers.

Thanks,

Improve this answer
4

Under System->Advanced->Firewall and NAT there is an option "Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it originated from."

Improve this answer
1
  • I found it is better to use Services->DNS Resolver->General Settings and check Register DHCP leases in the DNS Resolver and Register DHCP static mappings in the DNS Resolver then add the server to the Host Overrides.
    – Paul
    Commented Nov 10, 2015 at 20:49
0

The solution is in the link posted by user15469: https://doc.pfsense.org/index.php/Why_can't_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks

Create a split DNS by configuring a host override for the DNS Resolver or Forwarder (whichever one you're using) in pfSense.

Also remember to apply the changes in pfSense, and clear the DNS cache of the computer you're testing with.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.