Messages

[1_HTTP_frontend]

Part 6 in the tutorial adds support for hosting public services as well as internal services. This works great, but after some consideration I deemed it too risky. The safety of the internal services ending up publicly on the net is the src address condition rule. In addition, the webui of OPNsense (currently 26.1.9) doesn't handle the order of the "select rules" where it is critical to get the order of the `LOCAL_SUBDOMAINS_rule` and the `PUBLIC_SUBDOMAINS_rule` to have a functioning setup. I deemed this too risky.

I was running 1_HTTP_frontend and 1_HTTPS_frontend directly to 0.0.0.0:80 and 0.0.0.0:443 respectively. I'm not running 0_SNI_frontend.

1. Clone 1_HTTP_frontend into 1_HTTP_WAN_frontend. Change the listen address to use the *WAN* address :80.
2. Clone 1_HTTP_frontend into 1_HTTP_LAN_frontend. Change the listen address to use the *LAN* address :80.
3. Disable 1_HTTP_frontend
4. Clone 1_HTTPS_frontend into 1_HTTPS_WAN_frontend. Change the listen address to use the *WAN* address :443. Under Select rules, select only the PUBLIC_SUBDOMAINS_rule.
5. Clone 1_HTTPS_frontend into 1_HTTPS_LAN_frontend. Change the listen address to use the *LAN* address :443. User Select rules, select only the LOCAL_SUBDOMAINS_rule.
6. Disable 1_HTTPS_frontend.
7. Press Apply

For this to work, one needs to override the external addresses to internal addresses.

8. Go to Unbound DNS -> Overrides.
9. Add a new entry. Set host, domain and entry. Use the IP for the *LAN* port from above. E.g. www, my.domain, A to 192.168.1.1.
10. Rinse an repeat for all entries that must be overridden.

This is an excellent tutorial. I'm fairly new to opnsense, and this was a great start to get me going getting the services up and running. @TheHellSite I appreciate the work you have dedciated to it, despite your busy schedule. Thank you.

With OPNsense 26.1.9, some of the settings have moved or not available, so there were placed I had to think and google to proceed. Ideally, the guide should be updated, but I know its a big ask.

There isn't a need to enable NAT reflection it seems (which puzzled me a little bit why it was working to connect from LAN). What I think happens is when a package from LAN destined for the public IP, opnsense will see that the package is for itself using its public facing IP and send it directly to HAproxy without NAT due to its `0.0.0.0:443` listen of `0_SNI_frontend`. So perhaps "part 6" should be updated? I'm left with the open question: When do we use option A) Split DNS or B) NAT reflection when option 0) Do nothing seems to work?

Is it always necessary to create a backend and a server when there is 1 to 1 relationship between the two? Can it be combined somehow? I assume this is a core design of HAProxy?