Hi,
I made further test and I'm sure that the problem is on firewall. If I disabled it, I'm able to surf my Web site both with HTTP and HTTPS. Whereas with firewall enabled I can only connect to GUI interface and via SSH.
The nmap command executed from the zentyal server:
sudo nmap -sT -O -Pn myURL
Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-01 10:50 CEST
Nmap scan report for myURL (myIP)
Host is up (0.00011s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
443/tcp open https
8443/tcp open https-alt
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.8 - 4.9
Network Distance: 0 hops
while the same nmap command executed from a different machine:
sudo nmap -sT -O -Pn myURL
Starting Nmap 7.01 ( https://nmap.org ) at 2019-07-01 10:52 CEST
Nmap scan report for myURL (myIP)
Host is up (0.070s latency).
Not shown: 931 filtered ports, 66 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
8443/tcp open https-alt
Device type: general purpose|WAP|specialized|storage-misc|printer
Running (JUST GUESSING): Linux 3.X|4.X|2.6.X (94%), Asus embedded (90%), Crestron 2-Series (89%), HP embedded (89%), Ubiquiti embedded (88%)
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel cpe:/h:asus:rt-ac66u cpe:/o:crestron:2_series cpe:/h:hp:p2000_g3 cpe:/o:linux:linux_kernel:2.6.32 cpe:/h:ubnt:airmax_nanostation
Aggressive OS guesses: Linux 3.10 - 3.19 (94%), Linux 3.2 - 4.0 (91%), Linux 3.13 (90%), Asus RT-AC66U WAP (90%), Linux 3.10 (90%), Linux 3.11 - 3.12 (90%), Linux 3.18 (90%), Crestron XPanel control system (89%), HP P2000 G3 NAS device (89%), Linux 2.6.32 (88%)
No exact OS matches for host (test conditions non-ideal).
Finally, the same nmap command executed from a different machine with zentyal firewall disabled:
sudo nmap -sT -O -Pn myURL
Starting Nmap 7.01 ( https://nmap.org ) at 2019-07-01 10:53 CEST
Nmap scan report for myURL (myIP)
Host is up (0.059s latency).
Not shown: 994 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
135/tcp filtered msrpc
443/tcp open https
8443/tcp open https-alt
Aggressive OS guesses: Linux 3.10 - 3.19 (95%), Linux 3.18 (93%), Linux 3.2 - 4.0 (93%), Linux 3.13 (92%), Asus RT-AC66U WAP (92%), Linux 3.10 (92%), Linux 3.11 - 3.12 (92%), HP P2000 G3 NAS device (91%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (90%), Linux 2.6.18 - 2.6.22 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 15 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.56 seconds
So the Web server ports (80-443) are not open. I configured port forwarding from the zentyal firewall GUI and it seem quite straightforward. I do not see any error.
sudo iptables -t nat -v -x -n -L
Chain PREROUTING (policy ACCEPT 6911 packets, 417031 bytes)
pkts bytes target prot opt in out source destination
7036 424495 premodules all -- * * 0.0.0.0/0 0.0.0.0/0
29 1740 DNAT tcp -- eth0 * 0.0.0.0/0 myIP tcp dpt:443 to:myIP
96 5724 DNAT tcp -- eth0 * 0.0.0.0/0 myIP tcp dpt:80 to:myIP
Chain INPUT (policy ACCEPT 338 packets, 20208 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1307 packets, 80122 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 1307 packets, 80122 bytes)
pkts bytes target prot opt in out source destination
1307 80122 postmodules all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 SNAT tcp -- * * 0.0.0.0/0 myIP tcp dpt:443 ctstate DNAT to:myIP
0 0 SNAT tcp -- * * 0.0.0.0/0 myIP tcp dpt:80 ctstate DNAT to:myIP
Chain postmodules (1 references)
pkts bytes target prot opt in out source destination
Chain premodules (1 references)
pkts bytes target prot opt in out source destination
sudo iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
preinput all -- anywhere anywhere
idrop all -- anywhere anywhere state INVALID
iaccept all -- anywhere anywhere state RELATED,ESTABLISHED
inospoof all -- anywhere anywhere
iexternalmodules all -- anywhere anywhere
iexternal all -- anywhere anywhere
inoexternal all -- anywhere anywhere
imodules all -- anywhere anywhere
iglobal all -- anywhere anywhere
iaccept icmp !f anywhere anywhere icmp echo-request state NEW
iaccept icmp !f anywhere anywhere icmp echo-reply state NEW
iaccept icmp !f anywhere anywhere icmp destination-unreachable state NEW
iaccept icmp !f anywhere anywhere icmp source-quench state NEW
iaccept icmp !f anywhere anywhere icmp time-exceeded state NEW
iaccept icmp !f anywhere anywhere icmp parameter-problem state NEW
idrop all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
preforward all -- anywhere anywhere
fdrop all -- anywhere anywhere state INVALID
faccept all -- anywhere anywhere state RELATED,ESTABLISHED
fnospoof all -- anywhere anywhere
fredirects all -- anywhere anywhere
fmodules all -- anywhere anywhere
ffwdrules all -- anywhere anywhere
fnoexternal all -- anywhere anywhere
fdns all -- anywhere anywhere
fglobal all -- anywhere anywhere
faccept icmp !f anywhere anywhere icmp echo-request state NEW
faccept icmp !f anywhere anywhere icmp echo-reply state NEW
faccept icmp !f anywhere anywhere icmp destination-unreachable state NEW
faccept icmp !f anywhere anywhere icmp source-quench state NEW
faccept icmp !f anywhere anywhere icmp time-exceeded state NEW
faccept icmp !f anywhere anywhere icmp parameter-problem state NEW
fdrop all -- anywhere anywhere
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
preoutput all -- anywhere anywhere
odrop all -- anywhere anywhere state INVALID
oaccept all -- anywhere anywhere state RELATED,ESTABLISHED
ointernal all -- anywhere anywhere
omodules all -- anywhere anywhere
oglobal all -- anywhere anywhere
oaccept icmp !f anywhere anywhere icmp echo-request state NEW
oaccept icmp !f anywhere anywhere icmp echo-reply state NEW
oaccept icmp !f anywhere anywhere icmp destination-unreachable state NEW
oaccept icmp !f anywhere anywhere icmp source-quench state NEW
oaccept icmp !f anywhere anywhere icmp time-exceeded state NEW
oaccept icmp !f anywhere anywhere icmp parameter-problem state NEW
odrop all -- anywhere anywhere
Chain drop (5 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 50/min burst 10 LOG level debug prefix "zentyal-firewall drop "
DROP all -- anywhere anywhere
Chain faccept (12 references)
target prot opt source destination
NFQUEUE all -- anywhere anywhere NFQUEUE num 0
ACCEPT all -- anywhere anywhere
Chain fdns (1 references)
target prot opt source destination
faccept udp -- anywhere one.one.one.one state NEW udp dpt:domain
faccept tcp -- anywhere one.one.one.one state NEW tcp dpt:domain
Chain fdrop (4 references)
target prot opt source destination
drop all -- anywhere anywhere
Chain ffwdrules (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain fglobal (1 references)
target prot opt source destination
faccept all -- anywhere anywhere
Chain fmodules (1 references)
target prot opt source destination
Chain fnoexternal (1 references)
target prot opt source destination
Chain fnospoof (1 references)
target prot opt source destination
fnospoofmodules all -- anywhere anywhere
fdrop all -- myIPNetwork/24 anywhere
Chain fnospoofmodules (1 references)
target prot opt source destination
Chain fredirects (1 references)
target prot opt source destination
LOG tcp -- anywhere myURL state NEW tcp dpt:https limit: avg 50/min burst 10 LOG level debug prefix "zentyal-firewall redirect "
faccept tcp -- anywhere myURL state NEW tcp dpt:https
LOG tcp -- anywhere myURL state NEW tcp dpt:http limit: avg 50/min burst 10 LOG level debug prefix "zentyal-firewall redirect "
faccept tcp -- anywhere myURL state NEW tcp dpt:http
Chain ftoexternalonly (0 references)
target prot opt source destination
fdrop all -- anywhere anywhere
Chain iaccept (34 references)
target prot opt source destination
NFQUEUE all -- anywhere anywhere NFQUEUE num 0
ACCEPT all -- anywhere anywhere
Chain idrop (3 references)
target prot opt source destination
drop all -- anywhere anywhere
Chain iexternal (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
iaccept tcp -- anywhere anywhere tcp dpt:ssh state NEW
iaccept tcp -- anywhere anywhere tcp dpt:https state NEW
iaccept tcp -- anywhere anywhere tcp dpt:http state NEW
drop tcp -- anywhere anywhere tcp dpt:5900 state NEW
drop tcp -- anywhere anywhere tcp dpt:6900 state NEW
Chain iexternalmodules (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain iglobal (1 references)
target prot opt source destination
iaccept udp -- anywhere anywhere udp dpt:kerberos state NEW
iaccept tcp -- anywhere anywhere tcp dpt:kerberos state NEW
iaccept tcp -- anywhere anywhere tcp dpt:loc-srv state NEW
iaccept udp -- anywhere anywhere udp dpt:netbios-ns state NEW
iaccept udp -- anywhere anywhere udp dpt:netbios-dgm state NEW
iaccept tcp -- anywhere anywhere tcp dpt:netbios-ssn state NEW
iaccept udp -- anywhere anywhere udp dpt:ldap state NEW
iaccept tcp -- anywhere anywhere tcp dpt:ldap state NEW
iaccept tcp -- anywhere anywhere tcp dpt:microsoft-ds state NEW
iaccept udp -- anywhere anywhere udp dpt:kpasswd state NEW
iaccept tcp -- anywhere anywhere tcp dpt:kpasswd state NEW
iaccept tcp -- anywhere anywhere tcp dpt:ldaps state NEW
iaccept tcp -- anywhere anywhere tcp dpt:3268 state NEW
iaccept tcp -- anywhere anywhere tcp dpt:3269 state NEW
iaccept tcp -- anywhere anywhere tcp dpts:49152:65535 state NEW
iaccept udp -- anywhere anywhere udp dpt:ntp state NEW
iaccept udp -- anywhere anywhere udp dpt:domain state NEW
iaccept tcp -- anywhere anywhere tcp dpt:domain state NEW
iaccept tcp -- anywhere anywhere tcp dpt:5900 state NEW
iaccept tcp -- anywhere anywhere tcp dpt:6900 state NEW
iaccept tcp -- anywhere anywhere tcp dpt:ssh state NEW
iaccept tcp -- anywhere anywhere tcp dpt:8443 state NEW
iaccept tcp -- anywhere anywhere tcp dpt:ftp-data state NEW
iaccept tcp -- anywhere anywhere tcp dpt:ftp state NEW
Chain imodules (1 references)
target prot opt source destination
Chain inoexternal (1 references)
target prot opt source destination
Chain inointernal (0 references)
target prot opt source destination
Chain inospoof (1 references)
target prot opt source destination
inospoofmodules all -- anywhere anywhere
idrop all -- myIPNetwork/24 anywhere
Chain inospoofmodules (1 references)
target prot opt source destination
Chain log (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 50/min burst 10 LOG level debug prefix "zentyal-firewall log "
RETURN all -- anywhere anywhere
Chain oaccept (11 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain odrop (2 references)
target prot opt source destination
drop all -- anywhere anywhere
Chain oglobal (1 references)
target prot opt source destination
oaccept all -- anywhere anywhere state NEW
Chain ointernal (1 references)
target prot opt source destination
oaccept udp -- anywhere one.one.one.one state NEW udp dpt:domain
oaccept tcp -- anywhere one.one.one.one state NEW tcp dpt:domain
Chain omodules (1 references)
target prot opt source destination
oaccept tcp -- anywhere anywhere tcp dpt:http
Chain preforward (1 references)
target prot opt source destination
Chain preinput (1 references)
target prot opt source destination
Chain preoutput (1 references)
target prot opt source destination