Link to home
Start Free TrialLog in
Avatar of CPA_MCSE
CPA_MCSE

asked on

Unable to access browser-based app from outside the firewall

I cannot access/launch a browser-based app (Silverlight) from outside the router (i.e. Internet).  I am getting "This page can’t be displayed" error.
•I updated our external DNS record to point to the internal server FQDN.  When I ping the FQDN, it returns the external IP address of the router.
•On the router, I have port 443 forwarding to the IP address of the correct server.
•I turned off the server software firewalls, but still no joy.
•I installed a wildcard SSL certificate.

Again, everything works fine from within the router (without using lmhost file).  I think the problem may be DNS related, but other than what I've already done, what else might need to be changed?

Error:

This page can’t be displayed

•Make sure the web address https://server.domain.com is correct.
•Look for the page with your search engine.
•Refresh the page in a few minutes.
Avatar of Cliff Galiher
Cliff Galiher
Flag of United States of America image

If it works within the network but not outside, two possibilities come to mind:

1) Silverlight, being an application framework, can open additional ports. You may need to forward more that 443. Whoever wrote your silverlight app should be able to provide more details.

2) Your router is not properly forwarding port 443. See if any traffic is hitting your server. Wireshark, netmon, or even IIS logs would be helpful here. In some cases, routers (and even some UTM devices) use 443 for management, and improperly configured, will not forward 443 at all because it assumes it is for management, and those rules supercede the port forwarding rules set up by users. Each router is different in this regard, so I can't get more specific.
Avatar of CPA_MCSE
CPA_MCSE

ASKER

Thanks for the feedback.

1.  It is a default and by-the-book install of a Microsoft web app.  Documentation states only port 443 need be forwarded.

2.  Based on your feedback, I moved the server to a different subnet with a different physical router, set port-forwarding to the new internal IP address, and updated/tested the external DNS record for that server to point to the external IP address of that router.  I also turned off all software firewalls on the server.  Still no joy...

As the server is joined to a pristine W2012 R2 test domain with default settings, might there be something there I would need to change?  Grasping at straws here...
ASKER CERTIFIED SOLUTION
Avatar of CPA_MCSE
CPA_MCSE

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
My testing determined ISP is blocking port 443.