0

I have the following setup:

          ISP
           |
           |
        external interface (public ip)
       /
Router (running OPNsense)
       \
        internal interface 192.168.0.1
            |
          /   \
        /       \
      /           \
 webserver       other lan clients
 192.168.0.2    192.168.0.3-100 (from dhcp)

My Router is not able to connect to the webserver via it's public IP-address but the rest of the 192.168.0.0/24 net is.

I have set portforwards for the WAN interface on port 80 and 443 to my webserver and enabled "Reflection for port forwards" as well as "Automatic outbound NAT for Reflection" in the advanced settings for the firewall.

Anyone got an idea why my router is not able to connect to the webserver via it's external-IP.

To rule out the webserver as point of failure I setup a dummy ssh server (raspberry pi) and portforward some port to the pi's ssh port with the exact same result. The whole 192.168.0.0/24 network can connect to the pi via its public ip (domainname) except from the router.

Improve this question
1
  • There are many questions with answers here about this if you search.
    – Ron Maupin ♦
    Commented Jun 2 at 14:37

1 Answer 1

Reset to default
0

My Router is not able to connect to the webserver via it's public IP-address ...

That is to be expected. Accessing the web server by public IP requires destination NAT aka reverse NAT aka port forwarding, which the router doesn't do for its own source address.

Use the web server's private IP instead.

... but the rest of the 192.168.0.0/24 net is.

You private clients should use the server's private address for access as well, in order to avoid the inefficient client-router-server loop with hairpin NAT. You might want to consider split-brain DNS (off topic here) for simplicity.

Improve this answer
3
  • Thank you for your answer. Indeed I was thinking about using split DNS, the thing is, that externally I dont't use standard ports except for HTTP and HTTPS. So I would have to also define NAT rules for the local addresses?
    – peter
    Commented Jun 2 at 11:04
  • Just use the same non-standard ports internally as well. Note that uncommon ports do not really increase security.
    – Zac67 ♦
    Commented Jun 2 at 11:43
  • I do mainly use non standard ports because i want to be able to ssh to variois clients behind the same public ip address. Using different ports allows me to specify port forwards to the correct client. I now again tried split dns, now locally my domainname resolves to 192.168.0.1 and I have port forwards to the webserver, I still can access the webserver from all clients but the router itself
    – peter
    Commented Jun 2 at 18:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.