How do I port forward SSL?

audiodef · Posted: Wed Feb 23, 2011 3:42 pm Post subject: How do I port forward SSL?

I have one of these:

http://www.ehow.com/how_4663412_enable-miwr-verizon-fios-router.html

I know about setting up port forwarding. What I want to do is set up SSL port forwarding. https://localhost works. When I get the router's IP and put that in my browser (using http, not https), it gets forwarded to http://localhost. Now I want to do the same thing, except with https.

In other words, if the router's IP is 12.345.67.89, I want to be able to put https://12.345.67.89 in my browser have it forward to https://localhost, the same way it works with http. I have SSL set up on my localhost already.

I've done this before, just on a different router, and I've forgotten what needs to be done.
_________________
decibel Linux: https://decibellinux.org
Github: https://github.com/Gentoo-Music-and-Audio-Technology
Facebook: https://www.facebook.com/decibellinux
Discord: https://discord.gg/73XV24dNPN

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

Not sure about this router but I imagine that setting up port 443 instead of 80 will do the trick.

audiodef · Posted: Wed Feb 23, 2011 6:55 pm Post subject:

It doesn't appear to be that simple.

I wonder if I still have to configure something for apache. Is it enough to see that https://localhost works to expect a port forward to work on SSL?
_________________
decibel Linux: https://decibellinux.org
Github: https://github.com/Gentoo-Music-and-Audio-Technology
Facebook: https://www.facebook.com/decibellinux
Discord: https://discord.gg/73XV24dNPN

titanofold · Posted: Wed Feb 23, 2011 7:42 pm Post subject:

Yeah, not that simple. What you need is a page or a redirect rule to send people from HTTP to HTTPS.

So you'd have a virtual host listening on port 80 only to serve that redirect page or to issue that redirect command.

EDIT: Whoops! Now that I read your post again, I realize that's not what you were looking to have happen.

Would you post your SSL config for Apache?
_________________
The best things in life are free.
Guy-1: Surely, you will fold with me...
Guy-2: Alright, but don't call me Shirley

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

Ok maybe I misread this post in the first place, let me try and clarify the problem.

1: Is this a question of your apache setup on your server?

If so I think what you are trying to do is to redirect a http request and proxy it to a https one either to your local server or another server.

If you want to switch from http to https on the local server you can simply add a redirect rule assuming that your https is already setup:

RedirectMatch /(.*) https://localhost
RedirectMatch / https://localhost

If you want to proxy and use ssl also then you need to setup an ssl proxy directive also

SSLProxyEngine On

ProxyRequests Off
ProxyPreserveHost Off

ProxyPass / https://other-server
ProxyPassReverse / https://other-server

Hope I have understood the question :lol:

audiodef · Posted: Tue Mar 01, 2011 2:02 pm Post subject:

Here's my /etc/apache2/httpd.conf:

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

In that case your apache setup may be fine, to double check this I would attempt to connect from another machine on your LAN to the actual IP of your server just to prove the SSL is listing on the external and not just (localhost)

If you setup a redirect on the apache side this may solve the issue you have add the below. now when you connect to http://localhost it should redirect you to https://localhost

vi /etc/apache2/vhosts.d/default_vhost.include

titanofold · Posted: Tue Mar 01, 2011 2:24 pm Post subject:

In your 00_default_ssl_vhost.conf, are you allowing connections from all, or just from localhost?
_________________
The best things in life are free.
Guy-1: Surely, you will fold with me...
Guy-2: Alright, but don't call me Shirley

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

This is what I would put there unless you have good reason not to.

titanofold · Posted: Tue Mar 01, 2011 2:30 pm Post subject:

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

That will bind apache to all network cards that are up if I'm not mistaking,
Which line of the config are you refering to?

titanofold · Posted: Tue Mar 01, 2011 2:37 pm Post subject:

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

@titanofold

The point I was making was if the config was as follows then it would not be listening as an external interface and this ~I think would cause a problem

titanofold · Posted: Tue Mar 01, 2011 2:56 pm Post subject:

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom

@audiodef

1 question to clarify . . .

1: Is Port forwarding setup on port 443 on your router?

If yes then stop apache and do the following as root

emerge net-analyzer/netcat

Run the following command as Root User
nc -l -p 443

Now get someone to connect externally over https

You should now see an output from the terminal you ran the command, this proves then that your port forwarding is working correctly so all you need to do is sort out your apache config.

audiodef · Posted: Wed Mar 02, 2011 4:26 pm Post subject:

Here's the latest:

I get no output with that command, whether apache is running or not. However, reading through this thread sparked a suspicion. I put my router's current IP address into the exceptions for my TOR setup, and HTTPS sailed right through. I'll have to come back to this later, when I've solved the following problem:

HTTPS requests land on the login page for the router, not on my apache's localhost (HTTP requests land on my apache's localhost as expected). In my port forwarding section, I have two forwards:

192.168.1.3:80, HTTP TCP Any -> 80
192.168.1.3:443, Application TCP 443 -> 443

There's nothing about forwarding 443 to 192.168.1.1, which is the router.

I wonder if the fact that the 443 forward rule is an "application" and not "http" has anything to do with it. I didn't see a way to have any control over this, though.

Maybe at this point, my apache config needs to be tweaked. Here's my SSL config:

titanofold · Posted: Wed Mar 02, 2011 8:43 pm Post subject:

There should be a page that allows you to control the routers remote management. This may be what is actually interfering with the connections getting in on port 443.

You can certainly have SSL on a different port, you just need to be able to tell the user agent that it'll be SSL. That is, the browser should be looking for https://yo.ur.ip:444 rather than http://yo.ur.ip:444
_________________
The best things in life are free.
Guy-1: Surely, you will fold with me...
Guy-2: Alright, but don't call me Shirley

audiodef · Posted: Thu Mar 03, 2011 1:45 am Post subject:

titanofold · Posted: Thu Mar 03, 2011 10:59 am Post subject:

You should be able to edit the port forwarding now so that it points to the server now. And it should be HTTPS as its service for that port.
_________________
The best things in life are free.
Guy-1: Surely, you will fold with me...
Guy-2: Alright, but don't call me Shirley

audiodef · Posted: Thu Mar 03, 2011 2:42 pm Post subject:

I must have totally spaced on the fact that I should select HTTPS from the list of applications to forward. I did so, and now I have HTTPS forwarded to the local address of my server, but I'm still getting connection refused messages.

_________________
decibel Linux: https://decibellinux.org
Github: https://github.com/Gentoo-Music-and-Audio-Technology
Facebook: https://www.facebook.com/decibellinux
Discord: https://discord.gg/73XV24dNPN

cach0rr0 · Posted: Fri Mar 04, 2011 4:38 am Post subject:

what sort of router, out of curiosity?

I had something like this with a Netgear WNR2000. Never had such an issue on any of my Linksys rigs.
I could access everything fine coming in from outside, but internally, it ended up connecting to the web management interface for the router.

Can't remember what I had to change. May have been one of the RIP settings, not sure.

Highly suggest you find an external host with nmap, easier to figure this sort of thing out. Maybe you have a friend with a spare shell!