A customer is using a NetScreen-25 firewall. By default it has a web interface on port 80 and 443. I've changed the port for the HTTPS web interface to some other number that is not being used and disabled the checkbox that normally enabled the HTTPS web interface.

I've then added a policy to forward incoming tcp requests on port 443 to like I would add any other NAPT policy. However the policy is never hit (even though it's at the top of the list) so data never gets forwarded to the internal server.

We want to expose the internal site via HTTPS to the internet (without the user having to specify a port other than 443 of course).

Has anybody got an idea what might be wrong? Might this be a bug in the device given that it normally reserves 443 for it's web interface even when you change the port and disable it?

Thank you

  • 1
    Are you using MIP addresses or NAT in your policy? Could you possibly copy your policy line that is having problems and put it in the question? – Doug Luxem Sep 28 '09 at 18:58

And if you put the sever in the DMZ? It should bypass the firewall then. Does that work?

// Allowing Outbound Traffic By default, the NetScreen-25 device does not allow inbound or outbound traffic, nor does it allow traffic to or from the DMZ. You need to create access policies to permit specified kinds of traffic in the directions you want. (You can also create access policies to deny and tunnel traffic.) The following access policy permits all kinds of outbound traffic from any point on the Trust network to any point on the Untrust network. set policy outgoing “inside any” “outside any” any permit save You can also use the Outgoing Policy Wizard in the WebUI management application to create access policies for outbound traffic. See “Accessing the Device With the WebUI” on page 18 for information on accessing the WebUI application. //

  • Can't change any other settings... there are VPN's configured, other services etc... Funny thing is the single service defines port 80, 25, 135 and 443 If any of the above except for 443 is tested, the connection is refused immediatly while for 443 it takes like 30 seconds – TimothyP Sep 26 '09 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.