Nextcloud Iocage and PfSense

[Jailer]

Yes.

 

[nic_greene]

Yes.

@Jailer Thank you.
Is the other rule ok?

And do I need to setup any other rules for this IP, like in the LAN?

 

[Jailer]

The rules should be created automatically for each port forward.

 

[nic_greene]

The rules should be created automatically for each port forward.

@Jailer Thank you. So you are saying I don't need to create any rules within the LAN Tab of Firewall/Rules?

 

[KevDog]

Question? It doesn't sound like you know what ports you want open on your nextcloud? Do you run nextcloud over port 80? Is there a reverse proxy present somewhere? I'm just questioning your setup.

 

[nic_greene]

With the NAT Rules setup, the only thing missing was this in the DNS Resolver

 

[KevDog]

So is your reverse proxy running on same VM as Nextcloud?

 

[nic_greene]

So is your reverse proxy running on same VM as Nextcloud?

No. It's coming from Route 53. Actually got the mapping from Sam Dowlings Reverse Proxy Tut. Thanks @KevDog, I now have a working pfsense setup.

 

[KevDog]

@nic_greene
I'm glad you got it running OK. I don't use AWS at all -- am interested in trying it. What are you hosting there other than a reverse proxy?


One thing you might want to consider. Sam Dowling's tutorial describes a reverse proxy but I correct me if I'm wrong I think all of his stuff is running on AWS. Is your reverse proxy and nextcloud located on different physical machines?

 

[Jailer]

Dude, the reverse proxy is on Route 53 (he's said that at least 3 times in this thread) and points to his public IP. It's then forwarded to his jail via the port forward and host override he added above.

And @nic_greene your static IP's on your LAN won't show up in your DHCP lease page unless you add a static mapping since it's not a DHCP lease.

 

[danb35]

Dude, the reverse proxy is on Route 53 (he's said that at least 3 times in this thread) and points to his public IP.

It's possible that some of the confusion stems from wondering why he'd do that--I don't see the point in running a reverse proxy remotely that just proxies to resources on your LAN. Particularly when pfSense is perfectly capable of handling this itself.

 

[Jailer]

Unless you are running multiple services on your AWS and proxy one to your Nextcloud instance at your home. That would make sense.

 

[KevDog]

@Jailer -- however the reverse proxy instructions he's following makes an unencrypted http connection to the backend -- so why I wanted to ensure that if the rev proxy was on AWS and his pfsense/freenas/nextcloud was at home or another LAN -- then the reverse proxy would be proxying to unencrypted to remote sources. Hence me asking all the questions like a million times.

And unrelated -- why does nginx called backend servers "upstream"? That doesn't make a lot of sense to me!

 

[nic_greene]

@danb35 Yes, I use Route 53 to route traffic to my nextcloud and other sites/servers.
All of the traffic thru Route 53 is encrypted, used the hardened Nextcloud guide from @samuel-emrys here
@Jailer the Static Routes are now all working with static mapping, I managed to muddle through that with everyone's help

 

[samuel-emrys]

No. It's coming from Route 53. Actually got the mapping from Sam Dowlings Reverse Proxy Tut. Thanks @KevDog, I now have a working pfsense setup.

I think there might be some confusion here. All of the services I have run locally on my LAN, hosted in FreeNAS iocage jails. I don't run anything on AWS. The only reason I use Route 53 is to make my local services publicly routable, which is convenient because my _website_ is hosted using AWS.

The reverse proxy I've configured runs on my LAN. The rules I specify forward traffic to the reverse proxy jail, which forwards traffic to whichever service is being requested, in your case this is Nextcloud. This means that the rules I've specified won't necessarily apply to you if you've got a different configuration.

As far as your nextcloud instance showing up in pfSense goes, what's happening at the moment makes sense because the instructions I provide include a manual IP configuration. The manual IP I set is outside of my DHCP range, and I've added an alias for each service so that I can easily identify them when creating rules. Having said that, if you _want_ it to show up in your DHCP Leases/ARP table, adding a static mapping or any of the alternatives @danb35 suggested earlier would be appropriate. If you want the jail to draw a DHCP address though, you'll need to configure it that way. I normally just map these statically by IP instead of MAC.

Also a bit of a semantic point, but note that traffic doesn't go "through" Route 53 - It provides domain name system (DNS) resolution. All it is is a mapping of your website URL with your public IP. i.e., if you have three services, Nextcloud, Bitwarden, Heimdall, all hosted on a server on your home network, and your public IP address is 15.15.15.15, then you might create the equivalent of the following mappings in Route 53:

Service	Route 53 <url:ip> mapping
nextcloud	<cloud.example.com:15.15.15.15>
bitwarden	<bitwarden.example.com:15:15:15.15>
heimdall	<heimdall.example.com:15.15.15.15>

This means that if you navigate to http://cloud.example.com (i.e., you're making a GET request), your DNS service provider will ask Route 53 what the ip of this alias is, and it will resolve to 15.15.15.15. Then your client will make a connection with the socket 15.15.15.15:80. Exactly the same thing happens for the other services, bitwarden.example.com and heimdall.example.com. Each of them should resolve to your public IP. All of this to say that you have a "direct" (not considering intermediate hops) route to the server - nothing travels _through_ Route 53.



You can confirm this by running nslookup from a computer not connected to your LAN (if you have a local mapping for the service subdomains, as I detail in my guide, otherwise it should work from inside your LAN as well), which should show something similar to the following:

Code:

$ nslookup cloud.example.com
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
Name: cloud.example.com
Address: 15.15.15.15

With this in mind, @KevDog makes a valid point. If your reverse proxy is hosted on AWS (in an EC2/Elastic Beanstalk instance or similar) then the configuration I've provided won't be suitable since it makes unencrypted connections to the services. It's only encrypted from the reverse proxy onwards. This means that if you have locally hosted servers and your reverse proxy on AWS, then all of the traffic between your house and the AWS servers will be unencrypted. Not good.

 

[nic_greene]

@samuel-emrys Thanks for the very detailed explanation/clarification.

My nextcloud instance is setup following your guide. The only difference, presently, is that I have not set up the nginx reverse proxy in jail, as per your more recent guide. I plan to do this.

The situation I ran into, that prompted this post, was twofold: manual ip configuration in pfsense and how to get my nextcloud instance, on my local server, to be available via it's domain name. I had setup a box to run pfsense with aes-ni so I could use open vpn to tend to my network remotely, as well as being able to delve into better network security practices. I was upgrading from a Netgear Router which had limited capabilities and a very different way of handling manual ip entries.

As you point out route 53 is acting only for DNS resolution, so apologies for being ambiguous in my communication, but as it does follow your guide all traffic is encrypted and I've had this instance running for 9+ months now with very minor hiccups.

Thanks to all the forum users @KevDog, @Jailer, @danb35, @Apollo who obviously scratched their heads on what I was on about, whilst helping me get this sorted out.

@samuel-emrys I appreciate your guides because you 1) explain what is going on in simple terms, which is very helpful for someone like me and 2) are very willing to help out with bugs etc.,

I'd really be grateful for any input on SIMPLE guides to pfsense - but maybe what I am lacking is a basic primer on Networking and best practices because what I posted was initially confusing to other users.

 

[nic_greene]

Maybe I spoke to soon:
Getting this message in my freenas box: Feb 15 07:33:55 freenas dhclient[36403]: send_packet: No buffer space available
What does that mean? Better yet, what do I do about it?