VyOS Port Address Translation for HTTPS

[scottalanmiller]

I am trying to get HTTPS forwarded through a VyOS router. Here is where I am...

Firewall Settings for Port 443:

rule 40 {
            action drop
            destination {
                port 443
            }
            protocol tcp
            recent {
                count 4
                time 60
            }
            state {
                new enable
            }
        }
        rule 41 {
            action accept
            destination {
                port 443
            }
            protocol tcp
            state {
                new enable
            }
        }

And here are the NAT rules...

nat {
    destination {
        rule 100 {
            description "Port Forward: HTTPS to 192.168.1.31"
            destination {
                port 443
            }
            inbound-interface eth0
            protocol tcp
            translation {
                address 192.168.1.31
            }
        }
    }
    source {
        rule 100 {
            outbound-interface eth0
            source {
                address 192.168.0.0/22
            }
            translation {
                address masquerade
            }
        }
    }
}

I can ping 192.168.1.31 and if I use curl I can see the contents of the web page. So I know that things are working up until that point.

[JaredBusch]

@scottalanmiller said in VyOS Port Address Translation for HTTPS:

I am trying to get HTTPS forwarded through a VyOS router. Here is where I am...

VyOS or EdgeOS? They are not the same thing. Most likely nothing has changed here, but EdgeOS is not the same fork as VyOS.

[scottalanmiller]

@JaredBusch said in VyOS Port Address Translation for HTTPS:

@scottalanmiller said in VyOS Port Address Translation for HTTPS:

I am trying to get HTTPS forwarded through a VyOS router. Here is where I am...

VyOS or EdgeOS? They are not the same thing. Most likely nothing has changed here, but EdgeOS is not the same fork as VyOS.

Actual VyOS.

[scottalanmiller]

I had the firewall rule wrong so I cleaned that up. But still not working...

        rule 40 {
            action accept
            destination {
                address 192.168.1.31
                port 443
            }
            protocol tcp
            state {
                new enable
            }
        }

[JaredBusch]

Here are my EdgeOS Firewall rules for WAN_IN at one client.

 rule 1 {
     action accept
     description "Accept Established and Related"
     log disable
     state {
         established enable
         related enable
     }
 }
 rule 2 {
     action drop
     description "Drop Invalid"
     log enable
     state {
         invalid enable
     }
 }
 rule 6 {
     action accept
     description "Allow New to NginX Proxy"
     destination {
         address 10.202.1.16
         group {
             port-group HTTP_HTTPS
         }
     }
     log disable
     protocol tcp_udp
     state {
         new enable
     }
 }
 rule 8 {
     action accept
     description "Accept New for PBX"
     destination {
         group {
             port-group PBX_Ports
         }
     }
     log disable
     protocol udp
     source {
         group {
             address-group PBX_Addresses
         }
     }
     state {
         established disable
         invalid disable
         new enable
         related disable
     }
 }
 rule 9 {
     action accept
     description "Accept new for RDS"
     destination {
         address 10.202.1.13
         group {
             port-group RDS_Ports
         }
     }
     log disable
     protocol tcp
     state {
         established disable
         invalid disable
         new enable
         related disable
     }
 }
 rule 10 {
     action accept
     description "Accept New RDP"
     destination {
         address 10.202.1.13
         port 3389
     }
     log disable
     protocol tcp
     source {
         group {
             address-group RDP_Allowed_IP
         }
     }
     state {
         established disable
         invalid disable
         new enable
         related disable
     }
 }

[scottalanmiller]

And here is the current NAT file...

nat {
    destination {
        rule 10 {
            description "Port Forward: HTTPS to 192.168.1.31"
            destination {
                port 443
            }
            inbound-interface eth0
            protocol tcp
            translation {
                address 192.168.1.31
            }
        }
    }

[JaredBusch]

Here are the NAT rules.

 rule 1 {
     description "NginX Proxy"
     destination {
         address XXX.XXX.XXX.43
         group {
             port-group HTTP_HTTPS
         }
     }
     inbound-interface eth0
     inside-address {
         address 10.202.1.16
     }
     log disable
     protocol tcp_udp
     type destination
 }
 rule 3 {
     description "RDS HTTPS"
     destination {
         address XXX.XXX.XXX.44
         port 443
     }
     inbound-interface eth0
     inside-address {
         address 10.202.1.13
         port 443
     }
     log disable
     protocol tcp
     type destination
 }
 rule 4 {
     description "RDS RDP"
     destination {
         address XXX.XXX.XXX.44
         port 3389
     }
     inbound-interface eth0
     inside-address {
         address 10.202.1.13
         port 3389
     }
     log disable
     protocol tcp
     source {
         group {
             address-group RDP_Allowed_IP
         }
     }
     type destination
 }
 rule 5 {
     description "PBX Restricted Port Forward"
     destination {
         address XXX.XXX.XXX.42
         group {
             port-group PBX_Ports
         }
     }
     inbound-interface eth0
     inside-address {
         address 10.202.1.9
     }
     log disable
     protocol udp
     type destination
 }
 rule 5000 {
     description "Nginx Proxy"
     destination {
     }
     log disable
     outbound-interface eth0
     outside-address {
         address XXX.XXX.XXX.43
     }
     protocol all
     source {
         address 10.202.1.16
         group {
         }
     }
     type source
 }
 rule 5002 {
     description "RDS HTTPS"
     log disable
     outbound-interface eth0
     outside-address {
         address XXX.XXX.XXX.44
         port 443
     }
     protocol tcp
     source {
         address 10.202.1.13
         port 443
     }
     type source
 }
 rule 5003 {
     description "RDS RDP"
     destination {
         group {
             address-group RDP_Allowed_IP
         }
     }
     log disable
     outbound-interface eth0
     outside-address {
         address XXX.XXX.XXX.44
         port 3389
     }
     protocol tcp
     source {
         address 10.202.1.13
         port 3389
     }
     type source
 }
 rule 5005 {
     description "Default NAT Masquerade"
     log disable
     outbound-interface eth0
     protocol all
     type masquerade
 }

[scottalanmiller]

I'm working from the examples here...

http://vyos.net/wiki/User_Guide

[JaredBusch]

just comparing my Nginx rules to yours, it all looks laid out right.

[JaredBusch]

Did you apply the firewall rule to the interface?

[scottalanmiller]

@JaredBusch said in VyOS Port Address Translation for HTTPS:

Did you apply the firewall rule to the interface?

I've even rebooted!

[JaredBusch]

Do you have a source rule to match this? or does the source rule work on the default masquerade? i.e. you only have a single static IP involved here.

[JaredBusch]

You can see in my RDP rules that I have a source rule setup because it is a different IP than the default IP of the router.

[scottalanmiller]

@JaredBusch said in VyOS Port Address Translation for HTTPS:

Do you have a source rule to match this? or does the source rule work on the default masquerade? i.e. you only have a single static IP involved here.

I just removed the source rule to test. There is only one static IP at the moment.

[scottalanmiller]

Got it working. The firewall rule was in the wrong section of the firewall.

[JaredBusch]

@scottalanmiller said in VyOS Port Address Translation for HTTPS:

Got it working. The firewall rule was in the wrong section of the firewall.

You had it on eth0 local instead of eth0 in?

[scottalanmiller]

@JaredBusch said in VyOS Port Address Translation for HTTPS:

@scottalanmiller said in VyOS Port Address Translation for HTTPS:

Got it working. The firewall rule was in the wrong section of the firewall.

You had it on eth0 local instead of eth0 in?

Yuppers.