0

Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server. Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.


After we made the "big switch", the pfSense interface was responding on https://84.1.1.1, this is not intended as we want to use https://84.1.1.1 (port 443) for our web server. For this reason i changed the pfSense port from 443 to 444 which "solved" this issue as port 443 is "free" for other services now.

We won't allow access to the pfSense interface from our external ip at all but that is another problem which is off topic.


Now i wan to forward port 443, 80 (and in future some more) to servers in our network. For this i first want to explain how i configured the WAN connection as i noticed something.

I tried to ping (with the pfSense ping diagnostic tool) from WAN1 (our WAN) to the web server. This did not work which means that my port forwarding also cant work at all. I think that pfSense tries to resolve this ping request via its gateway so i tried to set the gateway of WAN1 to none and from this moment on i can ping the webserver from WAN1 (via the pfSense ping diagnose tool).

Question: Do i need to set a Gateway to our WAN1? I suppose yes? And if yes, do i need to make some exclusions for internal network somewhere? Just as extra info, maybe its required, we have a static IP which directly hangs on pfSense...

pfSense configuration

WAN INTERFACE
    <wan>
        <if>igb0</if>
        <descr><![CDATA[WAN1]]></descr>
        <alias-address></alias-address>
        <alias-subnet>32</alias-subnet>
        <spoofmac></spoofmac>
        <enable></enable>
        <ipaddr>84.1.1.1</ipaddr>
        <subnet>30</subnet>
        <gateway>WAN1GW</gateway>
    </wan>

GATEWAY
    <gateways>
        <defaultgw4>WAN1GW</defaultgw4>
        <defaultgw6></defaultgw6>
        <gateway_item>
            <interface>wan</interface>
            <gateway>84.1.1.2</gateway>
            <name>WAN1GW</name>
            <weight>1</weight>
            <ipprotocol>inet</ipprotocol>
            <descr><![CDATA[WAN1 gateway]]></descr>
        </gateway_item>
    </gateways>

OUTBOUND NAT RULES
    <nat>
        <outbound>
            <mode>advanced</mode>
            <rule>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr><![CDATA[Auto created rule for ISAKMP - AXN_INTRA to WAN1]]></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <staticnatport></staticnatport>
                <disabled></disabled>
                <destination>
                    <any></any>
                </destination>
                <dstport>500</dstport>
                <created>
                    <time>1589543460</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
                <updated>
                    <time>1591883208</time>
                    <username><![CDATA[admin@10.128.10.29 (Local Database)]]></username>
                </updated>
            </rule>
            <rule>
                <interface>wan</interface>
                <source>
                    <network>10.128.11.0/24</network>
                </source>
                <dstport>500</dstport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <staticnatport></staticnatport>
                <descr><![CDATA[Auto created rule for ISAKMP - AXN_SRV to WAN1]]></descr>
                <created>
                    <time>1589888715</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
                <disabled></disabled>
            </rule>
            <rule>
                <source>
                    <network>10.128.20.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <updated>
                    <time>1590582795</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </updated>
                <created>
                    <time>1590582795</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </created>
            </rule>
            <rule>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <updated>
                    <time>1591883222</time>
                    <username><![CDATA[admin@10.128.10.29 (Local Database)]]></username>
                </updated>
                <created>
                    <time>1591883222</time>
                    <username><![CDATA[admin@10.128.10.29 (Local Database)]]></username>
                </created>
            </rule>
            <rule>
                <source>
                    <network>10.128.12.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr><![CDATA[Default NAT rule for axn_cloud]]></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <created>
                    <time>1589896652</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </created>
                <updated>
                    <time>1590140198</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </updated>
            </rule>
            <rule>
                <source>
                    <network>10.128.11.0/24</network>
                </source>
                <sourceport></sourceport>
                <descr><![CDATA[Default NAT rule for axn_srv]]></descr>
                <target></target>
                <targetip></targetip>
                <targetip_subnet></targetip_subnet>
                <interface>wan</interface>
                <poolopts></poolopts>
                <source_hash_key></source_hash_key>
                <destination>
                    <any></any>
                </destination>
                <created>
                    <time>1589888715</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
                <updated>
                    <time>1590140250</time>
                    <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
                </updated>
            </rule>
        </outbound>
    </nat>

About the forwarding itself, i configured it like this:

enter image description here as i set Filter rule association to Add associated filter rule during the creation of the Port forward, pfSense automatically created the corresponding/required firewall rule on the WAN1 port.

enter image description here

Question: Do i need some additional configurations to forward port 443 and 80 near the configuration i already did? (the port forward and creating the required firewall rules)

3
  • "I tried to ping (with the pfSense ping diagnostic tool) from WAN1 (our WAN) to the web server. This did not work which means that my port forwarding also cant work at all." Ping and web services really have nothing to do with each other. Ping uses ICMP, but web services use HTML on TCP. Those are completely different protocols. in fact, ICMP (ping) does not use or know about other transport protocols, such as TCP or UDP, nor does it know about the addresses (ports) those other protocols use.
    – Ron Maupin
    Jun 12 '20 at 13:45
  • Thanks, i understand what you mean. How can this help solve my problem? Port 2xxx for our OpenVPN server can be forwarded without any issue. Clients can connect to the server which is "behind" pfSense
    – CodeNinja
    Jun 12 '20 at 14:04
  • Forwarding 80/443 was trivial and the bottom two screenshots match what I have. I find it interesting that you've blocked out a lot of the items in the title bar, one of which is not on a standard pfsense install. Are there other add-ons too? It seems there's a chance you have something else that's conflicting. Have you looked through logs for clues? I didn't create any rules in the firewall myself. I only added NAT port forward rules and let it create the firewall rules automatically. Did you do it another way?
    – kbulgrien
    Sep 15 '20 at 14:52
0

I run the same thing nginx on a different server that handout certificates to your services. First you need icmp echo reply configured because, for the dns provider to see you need that service and I use cloudns and they are good. Second on pfsense you need NAT configured to work and then 1:1 as well configured to allow the ports 80 and 443 to be open on your pfsense router. I will stop here for more info and I can give you pictures from my setup if it's easy this way. There are more steps to go through the configuration.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.