Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 21414 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Custom HTTPS port not showing up in URL

admin888

I am trying to publish an internal web server over the WAF. The setup is as follows:

  • Internal name: server.company.local , reachable via Port 8089.
  • External name: server.company.com (I have a public DNS record pointing to my static public ip).
  • I've created a real webserver with the internal hostname / IP as the host, Type: HTTP and port 8089.
  • I've created a virtual webserver with type: 'HTTPS & Redirect', port 8089 and a valid letsencrypt certificate for the public name.

I can access the website and login, so that worked. The first problem was that any link on the website pointed to the internal hostname. I resolved this by activating "Pass host header" in the virtual webserver. Now the links point to the correct hostname but the custom port (8089) is missing so when I click on a link it tries to establish the connection via port 443. What am I missing?



This thread was automatically locked due to age.
  • +1

    UTM/SG don't support rewriting URL this way ... as i know.

    i would try to use Port 443 for Virtual webserver (if not used already).

     


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    I already use Port 443 for Exchange services and only have one public IP address, so I'm guessing the only other option here is DNAT?

  • 0

    What if you change the Real Server to work with 443 and leave the Virtual Server on 8089?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Good point, I can try that. Meanwhile I've managed to access the links by manually adding the port to the URLs and the site is all screwed up (landing and login page were fine). I think the Javascript on those pages might cause problems for the WAF (I did try rewrite HTML on/off and no firewall profile).

  • 0 in reply to admin888

    It shouldn't be a problem having more than one server listening on the external 443 port. The mapping is done by WAF based on the certificate and the real server.
    I host several external domains all resolving to one IP / port 443
    Internally they are mapped to ports 8281, 8282 etc.

    Grtz, Peter-Paul

     
    SFVH (SFOS 20.0.0 GA-Build222) - Last (re)boot on November 6th  2023
    Asus H410i-plus - Pentium 6605 Gold - 250GB M.2 PCIe NVMe SSD - 8GB - 3 ports
    [If any of my posts are helpful to you please use the 'Verify Answer' link]
  • +1

    Not exactly sure why you have this problem, but here are two things to try:

    Option 1

    I am pretty sure that "HTTPS and Redirect" means that it accepts HTTP connections on port 80 but redirect to HTTPS on whatever port.   This might be creating confusion.  Try changing to HTTPS (without redirect) and see if the problem goes away.

    Option 2

    If you have WAF in front of your Exchange server, you can get rid of the custom port on the public IP using Server Name Indication (SNI)

    1) WAF on exchange.example.com:443 (public a.b.c.d) redirects to internal Exchange:443 (10.10.10.10)

    2) WAF on  otherapp.example.com:443 (public a.b.c.d) redirects to internal Otherstuff:8089 (10.10.10.11). 

    I perceive the second approach as preferable because the users are more likely to enter the URL correctly in the address bar or Favorites entry.

    Curious to hear your results.

  • 0 in reply to DouglasFoster

    On closer consideration, I think the most important option is "Rewrite HTML" on the Virtual Webserver object.  It is right next to "pass host header".   Your problem is that the urls are not being rewritten to external syntax.

  • 0 in reply to DouglasFoster

    Well that was easy. Your option 2 worked out perfectly, and the site is displaying properly too now. Thank you.

Unfiltered HTML