Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 33 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 7814 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Port forwarding within network- LAN to LAN (forward to docker app mapped port)

jang430

Hi.  I am using docker apps, inside Unraid NAS.  I set up a Nextcloud container (docker).  To be able to use it from outside, I created a DNAT rule so that from outside, I can access Nextcloud app.  It is working.  Nextcloud uses port 80 and port 443.  These ports are used by my Unraid NAS.  I mapped incoming http to port 380 of docker app, and incoming https to port 643 of docker app.  So far, so good.

DNAT rule

Source- WAN. Allowed client network- ANY

Destination- WAN port  Services- HTTP and another rule HTTPS

Protected Servers-  NAS IP  Mapped port- 380 and another port 643 for HTTPS

Protected zone- LAN

 

From inside the network, I can't access Nextcloud app



This thread was automatically locked due to age.
Parents
  • 0

    Sounds like the DNS is poiting towards the outside ip. But is thats they way you would like to use it, add the Lan zone aswell as source and it should work.

    Source- WAN and LAN. Allowed client network- ANY

    //Rickard

  • 0 in reply to RickardNordahl

    any other suggestions?

     

    Thanks!

  • 0 in reply to jang430

    I suggest you change your DNS settings in your DHCP server to something like mine as below.

     

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi.  I changed that in my DHCP settings.  192.168.1.1.  Now, when I do traceroute, I get:

     

    traceroute xxx.duckdns.org

    traceroute to xxx.duckdns.org (192.168.1.xx), 64 hops max, 52 byte packets

    1  xxx.duckdns.org (192.168.1.xx)  1.180 ms  1.144 ms  1.310 ms

    Jasons-MacBook-Pro-2:~ jason$

     

    That's an improvement :D. Although, accessing it through xxx.duckdns.org still says "Safari can't open the page."

     

     

     

     

  • 0 in reply to jang430

    One step at a time. That error message indicates you have a security issue with your device eg you have enabled https or TLS and you have not installed the XG CA on your MAC.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I used another device to access the xxx.duckdns.org and it presented my my NAS (device hosting the Nextcloud docker) 192.168.1.xx

    It didn't go to 192.168.1.xx:whatever_port_i'M_using.  While from the outside, whenever I access xxx.duckdns.org automatically routes to 192.168.1.xx:port.  But this can be addressed later.  

    The container is using LetsEncrypt, so I don't use Sophos CA as I don't know how to.  I'm just following video tutorials I've seen :D

  • 0 in reply to jang430

    Feels so close :D. Hope you can help me find the problem.

  • 0 in reply to jang430

    Hi,

    external routing is taken care of by your firewall rule.

    Did you install the let encrypt CA in your MAC?

    The XG CA is no different except you download it from the XG?

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Don't know how to install certificate manually.  All I know is when I visit a site, it asks whether I'd like to proceed/ accept.  I do accept to proceed.  In this scenario, I am not presented whether I'd like to accept  any certificate or not.  How do I trigger it?

  • 0 in reply to jang430

    I assume you received the CA in the mail and have saved it to your documents. Double on the CA and you will be asked some questions about installing and maybe trusting it.

    There's a KBA on the subject, I will try and locate it for you.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    In general, aren't we just supposed to visit the website, and it warns us, and we allow it to proceed?  I went 1 step further, and went to keychain access in my mac, and modified it to 'always trust'

     

    From External access, I didn't have to import or install any .cer file.  Is it any different if to access from within?

Reply
  • 0 in reply to rfcat_vk

    In general, aren't we just supposed to visit the website, and it warns us, and we allow it to proceed?  I went 1 step further, and went to keychain access in my mac, and modified it to 'always trust'

     

    From External access, I didn't have to import or install any .cer file.  Is it any different if to access from within?

Children
No Data
Unfiltered HTML