0

I'm using pfSense as our office firewall and am attempting to setup a second HTTPS server that needs to be visible to the outside. Because they are HTTPS servers, they need separate IP addresses. How do I configure pfSense to accept the other static IP addresses I've gotten from our ISP?

Assigned IPs: x.x.x.24-27 Gateway is x.x.x.28 pfSense version: 2.2.6

I've tried adding more NIC ports to the firewall, but pfSense doesn't like multiple interfaces using the same gateway.

pfSense documentation implies that an interface can't have multiple IP addresses and that wouldn't in this case anyhow, since the port 443 traffic needs to be separated out and redirected to different servers.

Virtual IPs sound promising, but I haven't managed to get one to ping yet.

Any suggestions on where I should be looking?

0

2 Answers 2

0

You don't want additional NICs. Just add virtual IPs on WAN for each additional IP. If it's cable service, you often have to power cycle the cable modem after doing so before the IPs will work.

"pfSense documentation implies that an interface can't have multiple IP addresses"

What'd you see that seemed to imply that? There certainly isn't anything intending to imply that.

1
  • 1
    Ok, I feel silly now. Rebooting the cable modem caused it to rescan for the other IPs and that fixed my issue. Virtual IPs working fine now. Feb 29, 2016 at 16:30
0

You can surely provide multiple HTTPS servers on the same IP address - you just need a server that supports SNI. I would recomment to use nginx as a reverse proxy for your http(s) services - nginx is a very powerful piece of software and can be used for much more purposes in future.

Doing this with pfsense is also quite straigh forward (if you've IP addresses available):

  1. Create a virtual IP on the pfsense
  2. Setup a firewall rule for that address
  3. create the NAT translation of the incoming connections.

That's it! A virtual ip is not a "native" ip address on an interface, so you may just not be able to ping the address (except you map this also to another host).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .