Error Issuing Cert: Timeout during connect (likely firewall problem)

[mmcphail00]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: mcwin.ddns.net

I ran this command: sudo certbot --apache

It produced this output:
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: mcwin.ddns.net
Type: connection
Detail: Fetching http://mcwin.ddns.net/.well-known/acme-challenge/0W0ikVfWp5AVgBL8m8YRTG8P3OxIVmtSkxuXhQp782A: Timeout during connect (likely firewall problem)

My web server is (include version): Apache 2.4.53

The operating system my web server runs on is (include version): Debian 11.3.0 (installed using non-free)

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.26.0

Different things I've done to test try and get this to work:

1. disable my vpn on my Asus AX88U router with Merlin
2. disable the firewall on the server
3. corrected my port forwarding for http and https
4. inbound firewall under network settings on the vpn client section on the router to "Allow"
5. installing the SSL cert from right within the router settings on the DDNS section of asus merlin v386.5.2 (never went through, continued to say "Authorizing")

After each attempt from the different things I've tried, I received an error message from LetsDebug.net as seen in Error1.png

I disabled the router firewall completely and received the error message as seen in Error2.png

I made sure that I used the public IP of my server when creating the A record using no-ip. Each time the public IP changed as a result of me turning off the vpn I updated the A record.

[webprofusion]

The DNS looks fine now, port 80 isn't currently open (or nothing is listening).

[rg305]

Are you running a VPN client?

Name:    used-for-vpn-packethub.net
Address: 108.62.107.226

[mmcphail00]

Sorry for the lack of replys. I was able to identify the problem. I recently had an AT&T fiber connection set up at my new place. In efforts to continue using my existing Asus router, I tried to run the two routers in bridge mode. The AT&T gateway doesn't have a bridge setting built-in. They have a setting called "Cascaded Router". Ultimately, it came down to me not setting up my bridge/cascaded router settings properly. And as I think about it, I know what I probably did wrong on my Asus router.

Regardless, I eventually removed the Asus router, leaving only the AT&T gateway. I set up the gateway using their NAT/Gaming set up, forwarded ports 80 and 443, and set up the No-IP DDNS record to the public IP on the gateway. After all of that I was able to successfully install the cert.

Now my only problem is that sometimes my nextcloud server is painfully slow at times. But that is obviously a problem for a different community thread.

[rg305]

@mmcphail00

my nextcloud server is painfully slow at times

If slow from within the same network, you might want to avoid hairpinning and access the server directly via the internal IP (not the Internet IP).
[just guessing...]