can't access HS3touch server on upgraded network

[lifespeed]

Recently I upgraded my home network to 10Gb optical switch with pfSense router. For the most part I have the network working as before, although the much greater configurability of pfSense has been a learning curve.

I have not been able to get HSTouch to access the server, which is the same Windows 10 Pro machine as before, running 3.0.0.435. The network card and IP address have changed, although static. And the Win 10 machine now gets an IPv6 address as well as IPv4. So let's start with what does work: I can access the HS3 web interface inside or outside the network, as firewall rules have been configured. I also forwarded port 10200 for HSTouch, but still can't access the server using Android app. I have tried turning off the windows firewall (rules are still there), but that didn't help. I can't use HSTouch inside or outside the network, using either my domain name or local IP address.

I have never used MyHSTouch relay or whatever that is, I saw no need. I could always access my HS3 directly. And I can still access all the other servers running on that machine, even HS3. Just not HSTouch.

[Rupp]

It sounds like a firewall or anti-virus issue. Did you try shutting down Windows firewall and your firewall, and all AV software and test?

[waynehead99]

Where did you setup the port forwarding in PFSense? When I first set this up, it got me too. Make sure you have a rule in your NAT tab as well as your WAN tab (usually it will auto add to your wan if you start at NAT, but there is a setting to disable that somewhere).

HS admin site doesn't use 10200 to access it, so my guess is you have either 443 or 80 open directly to your machine (or VPN, please don't forward 80 )

Send what your firewall rules look like and we can get this worked out for ya.

[lifespeed]

It sounds like a firewall or anti-virus issue. Did you try shutting down Windows firewall and your firewall, and all AV software and test?

I have tried turning off the windows firewall (rules are still there), but that didn't help.

I'll take a look at pfSense rules when I get home. I'm aware of NAT menu, and that it auto-adds a corresponding firewall rule when so configured. Currently HS3 web interface is running on port 8081, NAT'd and allowed through the firewall without issue. Which is why I'm confused about my inability to get HSTouch working. I checked the pfSense firewall logs, and it isn't rejecting attempts to access the Win 10 machine on port 10200.

Will report back tonight, thanks for the responses.

[randy]

It also could be a NAT reflection or “hairpinning” issue. This is an aspect of the router that redirects local IP calls back to the local network. pfSense does not enable it by default. It got me when I first installed pfSense. It has been a while since I used pfSense but IIRC it is on the firewall/NAT tab under advanced system settings. If not there Google “pfSense nat reflection”.

EDIT: look here.

[lifespeed]

It also could be a NAT reflection or “hairpinning” issue. This is an aspect of the router that redirects local IP calls back to the local network. pfSense does not enable it by default. It got me when I first installed pfSense. It has been a while since I used pfSense but IIRC it is on the firewall/NAT tab under advanced system settings. If not there Google “pfSense nat reflection”.

I believe I was aware of this configuration option when I created the NAT and firewall rules, and have not been using it. I'll double check when I get home and post config screenshots. The problem NAT reflection is attempting to cure, best resolved by "split DNS", may be the problem I am facing, however.

[Demusman]

NAT Redirection would not cause this. It redirects public addresses to your LAN, so if you have a server setup that you access remotely using your public address, you can use that same setup from on your LAN.

If you can't connect using the local address from your LAN, it has nothing to do with pfSense.
I would guess HSTouch needs to be updated with the new IP address scheme but that's just a guess right now.
Can you deploy to the android from the designer?
What are you using for an AP? you changed to pfSense (best thing you can do!) but how is the Android connecting? Thinking maybe you're using an old router for an AP that may be giving it the old IP scheme?

Check your ip on the Android, try to ping from the Android. Do the basics first is my point.
Don't go to the firewall, if you can't connect from your LAN.

[lifespeed]

NAT Redirection would not cause this. It redirects public addresses to your LAN, so if you have a server setup that you access remotely using your public address, you can use that same setup from on your LAN.

If you can't connect using the local address from your LAN, it has nothing to do with pfSense.
I would guess HSTouch needs to be updated with the new IP address scheme but that's just a guess right now.
Can you deploy to the android from the designer?
What are you using for an AP? you changed to pfSense (best thing you can do!) but how is the Android connecting? Thinking maybe you're using an old router for an AP that may be giving it the old IP scheme?

Check your ip on the Android, try to ping from the Android. Do the basics first is my point.
Don't go to the firewall, if you can't connect from your LAN.

This is what I thought. If I can't even access HSTouch server using the local IP, something is wrong other than pfSense. While it does appear I may still have some pfSense issues with the new network, it isn't clear this is one of them.

For an AP I am using Ubiquiti NanoHD, which is not a DHCP server - pfSense hands out IP addresses. What do you mean "HSTouch needs to be updated with the new IP address scheme"? I have two server configurations entered in HSTouch Android client right now: The original pointing to mydomain.com, and a new one pointing to the local IP of the Win 10 machine as a test. In the past pointing HSTouch client to mydomain.com worked fine both inside and outside the LAN. Currently, mydomain.com works from a web browser to access HS3 server interface inside and outside the LAN.

[Demusman]

Assuming your HS server now has a new IP address.

Open designer, go to tools/project defaults. You'll need to update the IP address in there.

Again, this is just a guess.

Also, can you deploy to the Android?

[lifespeed]

Assuming your HS server now has a new IP address.

Open designer, go to tools/project defaults. You'll need to update the IP address in there.

Again, this is just a guess.

Also, can you deploy to the Android?

Thank you, I was unaware of an IP address configuration in the menu you described. I will check this when I get home tonight. I don't know what "deploy to the Android" means, probably because I have not used designer. So far I've just used HSTouch as-is.

[Demusman]

As is? I don't think that's possible.
Are you sure you're not using HS mobile?

[drhtmal]

As is? I don't think that's possible.
Are you sure you're not using HS mobile?

There is a default HS Touch project you can deploy.

[Demusman]

There is a default HS Touch project you can deploy.

Right, DEPLOY. He said he never deployed anything.

[drhtmal]

Right, DEPLOY. He said he never deployed anything.

Understood. If you load/install --or what ever word you want to use to describe getting the app on the device-- HS Touch on a tablet or phone the default project is there so there is no need to deploy anything because the default project is installed by default.

[Demusman]

Understood. If you load/install --or what ever word you want to use to describe getting the app on the device-- HS Touch on a tablet or phone the default project is there so there is no need to deploy anything because the default project is installed by default.

Ok, gotcha. It didn't work that way for me.
i got a blue screen saying I had to "do something" that I can't remember anymore.
So how would it control your system if you didn't give it anything to control?