Half of requests block from internal host to itself - rdr rule

[francisaugusto]

Hi,

I have a setup where I have port forwarding setup for port 443 to my reverse proxy on one of my vlans.

The thing is that when my host send a request to the port 443 my WAN address, half of the time I get the request, half of the time I get connection refused.

It goes like this:

✘ francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account #works
 francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account
curl: (7) Failed to connect to auth.mydomain.com port 443: Connection refused
 ✘ francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account # works
 francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account
curl: (7) Failed to connect to auth.mydomain.com port 443: Connection refused
 ✘ francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account #works
 francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account
curl: (7) Failed to connect to auth.mydomain.com port 443: Connection refused
 ✘ francis@nginx $ curl https://auth.mydomain.com/realms/mydomain/account # works

Basically, every other request goes through.

When the connection is refused, I see a blue line log on firewall where the label says "rdr rule".

What can I do to fix this?

[Patrick M. Hausen]

Does auth.mydomain.com resolve to two different IP addresses?

[francisaugusto]

nope!

host auth.mydomain.com
auth.med-lo.eu has address XX.XX.XX.XX <--- my wan address

[francisaugusto]

I just realized now that this applies to all traffic to port 443 originating from the same vlan.

In short: when sending a request to port 443 of my WAN address from any host in the vlan where the port forwarding rule to port 443 sends traffic to, this happens. Half of requests goes through, half doesn't.

Is this a bug? Is there a way where I can override this behavior?

[cookiemonster]

Maybe hitting OPN UI intermittently. Did you disable the UI redirection on the port 443?

[francisaugusto]

yes, it is disabled, and I use another port for the UI.

[cookiemonster]

So you are testing from an inside VLAN, not from the outside. I didn't get that from the first post.
I would try changing the reflection setting in the nat:port-forward rule. I'm not 100% on that setting but I had trouble with a rule and had to change reflection from default to disabled. It fixed my problem but I can't explain it.

[francisaugusto]

It doesn't help - if I disable it, I get no traffic at all from my vlan that is sent to WAN at port 443.

[francisaugusto]

Things I tried so far:

- access from another host on the same vlan: same problem
- use another server instead of nginx, on another port: same problem
- disable nat reflector on the 443 port forwarding: no traffic from my vlan goes through, only external traffic.

[francisaugusto]

This is not a solution, but overriding the hostname internally via DNS seems to solve the issue. But I'd rather not do it since I'd have to do it for every domain name.