Help with SSL/TLS setup on FreeBSD 13.1

Do you know the manufacturer and model of your Router?
Getting the manual for it could be of assistance to you.

1 Like

Yes, it is Huawei DG8245W2 and I believe that the procedure is as explained in the manual. I will double check though.

Here is the guide to open the ports from my ISP, nova.is:

And here is the picture entailed:

The guide shows no error, where I get the error.

Thanks

1 Like

I couldn't download the manual from here https://support.huawei.com/enterprise/en/optical-access/dg8245w2-10-pid-22304976
I do not have an account (and not going to try creating one from my car on a cellphone).

1 Like

Even if I select Application and Web Server from the drop down menu I get this same error. Could it be that someone hacked in to the router and is using the service ports to control the router and thus the ports are already being used by some rootkit?
Here is a picture of the above procedure:

I appreciate the replies.

2 Likes

I suggest asking your ISP for support on that, as their example seem to be created by them.

1 Like

I am discussing the issue with them via email.
I tried to download the operation guide but Huawei don't allow it's download even if you register with them.
I will update here when I get a response from my ISP.

Thanks

2 Likes

What Ports do you connect to your Router's Web Interface?

I suspect 80 & 443, first you need to have the router web UI on alternate ports like 8080 & 8443. Then logout of the router and clear your web browser's cache and relogin to the router on the alternate ports. Then try your change again.

1 Like

I just use the regular 80 I believe. I type in 192.168.1.1 and log in as Useradmin. The browser gives me a warning on the top of the screen showing it is http not https so I'm guessing it's port 80.

192.168.1.1:8080 and 192.168.1.1:8443 give unable to connect and 192.168.1.1:443 gives a connection timed out.

I've cleared the cache and the problem persists:

Thanks

Since you are using Port 80 to connect to your router (i.e. your router has a little web server in it and has taken Port 80) Port 80 is unavailable to forward (or remap).

If that is the case then why do I get access to my web server if I type my external ip http://153.92.146.57:80
Doesn't that mean my router is forwarding port 80 to my server?

Thanks

1 Like

Yes, I was making guesses and assumptions based off of other router I've used that didn't work in that style. I'll try to find the full manual for your router. But your ISP is still the best bet for support knowledge.

1 Like

Where do you type it? I can't connect to your domain (IP) from the US.

Are you using a cell phone with wifi off to use your cell provider public network? Or a machine on someone else internet connection?

curl -i http://myrkur.net
curl: (7) Failed to connect to myrkur.net port 80 after 116 ms: Connection refused

nslookup myrkur.net
Address: 153.92.146.57
3 Likes

No success, Huawei is treating it as though it is a "Top Secret". :frowning:

1 Like

image
Because, as the error shows, 192.168.1.1 [your router] is already using port 443.

4 Likes

But as you can see in this picture, I get the same error if I only put port 80 in the external port number field. Ismyportopen.com says I have both ports open, and I can access the server now after I reformatted the server with FreeBSD 13.1 but I now get 403 Forbidden when I try to open the web server.
I followed these guides to set up a FAMP server:

After I included vhosts file the server just gives me a 403 Forbidden and https://myrkur.net gives the same Error code: PR_END_OF_FILE_ERROR

Does this mean I need a new router?

Thanks

1 Like

I was reformatting the server, the domain should be up at the moment with a 403 Forbidden error. I am using a Huawei DG8245W2 router, not on the phone. Thanks

1 Like

I believe your router is not correctly configured; since you have indicated it came from your ISP, have they been able provide any assistance on how to properly configure the router for your needs (i.e. Port 80 & 443 from the Pubic Facing Internet are sent to your FreeBSD server's Ports)?

1 Like

My ISP told me to reset the router to factory settings, I did that and still the same problem persists. At the moment I believe the problem lies with the server configuration, not the router, as both ports seem to be pointing to 192.168.1.102.

Thanks

2 Likes

If that is the case try each of these:
curl -Ii http://192.168.1.102
curl -Ii http://192.168.1.102:443
curl -Ii https://192.168.1.102

As this is what I see from your Public Facing Internet

$ curl -Ii http://www.myrkur.net
HTTP/1.1 403 Forbidden
Date: Thu, 16 Mar 2023 16:06:38 GMT
Server: Apache/2.4.56 (FreeBSD) OpenSSL/1.1.1o-freebsd PHP/8.2.0
Content-Type: text/html; charset=iso-8859-1
$ curl -Ii http://www.myrkur.net:443
HTTP/1.1 403 Forbidden
Date: Thu, 16 Mar 2023 16:06:41 GMT
Server: Apache/2.4.56 (FreeBSD) OpenSSL/1.1.1o-freebsd PHP/8.2.0
Content-Type: text/html; charset=iso-8859-1
$ curl -Ii https://www.myrkur.net
curl: (35) error:0A00010B:SSL routines::wrong version number
2 Likes
root@myrkur:/usr/local/docs # curl -Ii http://192.168.1.102
HTTP/1.1 403 Forbidden
Date: Thu, 16 Mar 2023 16:11:18 GMT
Server: Apache/2.4.56 (FreeBSD) OpenSSL/1.1.1o-freebsd PHP/8.2.0
Content-Type: text/html; charset=iso-8859-1

root@myrkur:/usr/local/docs # curl -Ii http://192.168.1.102:443
HTTP/1.1 400 Bad Request
Date: Thu, 16 Mar 2023 16:11:27 GMT
Server: Apache/2.4.56 (FreeBSD) OpenSSL/1.1.1o-freebsd PHP/8.2.0
Content-Length: 362
Connection: close
Content-Type: text/html; charset=iso-8859-1

root@myrkur:/usr/local/docs # curl -Ii https://192.168.1.102
curl: (60) SSL: no alternative certificate subject name matches target host name '192.168.1.102'
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
root@myrkur:/usr/local/docs # 

Thanks

2 Likes