0

I have a Raspberry Pi 5 fully updated and with the following OS:
Distributor ID: Debian
Description: Debian GNU/Linux 12 (bookworm)
Release: 12
Codename: bookworm

The raspberry is placed in a rack cabinet of our company. It smoothly connects to a WiFi network. There is no Ethernet cable plugged in the raspberry.

I installed two servers running on the Raspberry with associated domain names. The two servers are smoothly reachable remotely on the web through any browsers connecting to:
https://myserver1.domainXXX.net
https://myserver2.domainXXX.net
There is a port forwarding set on the company router for incoming connections to the specific ports. All connections from outside work very well.

In our company we have different routers and different WiFi networks. One of this wifi network is the one used by the Raspberry

I discovered that the two websites, that is, the two servers are not reachable from other computers connected to the network through the Ethernet cable or using other wifi networks, different from the one used by the Raspberry. The two servers are reachable only from outside the LAN or from devices connected to the same WiFi which Raspberry is connected to. For instance my desktop computer that uses the Ethernet cable cannot reach the two websites. My phone cannot reach them if connected to a WiFi with different SSID. If my phone is connected to the same SSID of the WiFi used by Raspberry, it can connects.

Moreover I tried to ping the raspberry from my Ubuntu desktop machine:

$ ping 192.168.1.104
PING 192.168.1.104 (192.168.1.104) 56(84) bytes of data.
64 bytes from 192.168.1.104: icmp_seq=1 ttl=64 time=75.9 ms
64 bytes from 192.168.1.104: icmp_seq=2 ttl=64 time=5.01 ms
64 bytes from 192.168.1.104: icmp_seq=3 ttl=64 time=7.97 ms
64 bytes from 192.168.1.104: icmp_seq=4 ttl=64 time=6.97 ms
64 bytes from 192.168.1.104: icmp_seq=5 ttl=64 time=6.96 ms
64 bytes from 192.168.1.104: icmp_seq=6 ttl=64 time=1.77 ms
64 bytes from 192.168.1.104: icmp_seq=7 ttl=64 time=19.1 ms
64 bytes from 192.168.1.104: icmp_seq=8 ttl=64 time=4.98 ms
64 bytes from 192.168.1.104: icmp_seq=9 ttl=64 time=4.96 ms
64 bytes from 192.168.1.104: icmp_seq=10 ttl=64 time=5.96 ms
64 bytes from 192.168.1.104: icmp_seq=11 ttl=64 time=12.0 ms
64 bytes from 192.168.1.104: icmp_seq=12 ttl=64 time=4.64 ms
--- 192.168.1.104 ping statistics ---
12 packets transmitted, 12 received, 0% packet loss, time 11013ms
rtt min/avg/max/mdev = 1.766/13.018/75.901/19.433 ms

and it seeems working, but not for the websites

My desktop computer is wired to the same router generating the SSID WiFi network which Raspberry is connected to. Raspberry IP is 192.168.1.104

The network admin said that there is no blocks among devices in the network. I don't know what else to do. If it could be helpful, this is an output from Raspberry:

$ nmcli device show
GENERAL.DEVICE:                         wlan0
GENERAL.TYPE:                           wifi
GENERAL.HWADDR:                         2C:CF:67:75:9F:B2
GENERAL.MTU:                            1500
GENERAL.DEVICE:                         wlan0
GENERAL.TYPE:                           wifi
GENERAL.HWADDR:                         2C:CF:67:75:9F:B2
GENERAL.MTU:                            1500
GENERAL.STATE:                          100 (connected)
GENERAL.CONNECTION:                     preconfigured
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/8
IP4.ADDRESS[1]:                         192.168.1.104/24
IP4.GATEWAY:                            192.168.1.1
IP4.ROUTE[1]:                           dst = 192.168.1.0/24, nh = 0.0.0.0, mt = 600
IP4.ROUTE[2]:                           dst = 0.0.0.0/0, nh = 192.168.1.1, mt = 600
IP4.DNS[1]:                             192.168.1.1
IP6.ADDRESS[1]:                         fe80::7ad1:6e07:a157:5e66/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 1024

GENERAL.DEVICE:                         br-d3908023bbd2
GENERAL.TYPE:                           bridge
GENERAL.HWADDR:                         02:42:F8:C4:D1:7D
GENERAL.MTU:                            1500
GENERAL.STATE:                          100 (connected (externally))
GENERAL.CONNECTION:                     br-d3908023bbd2
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/4
IP4.ADDRESS[1]:                         172.19.0.1/16
IP4.GATEWAY:                            --
IP4.ROUTE[1]:                           dst = 172.19.0.0/16, nh = 0.0.0.0, mt = 0
IP6.ADDRESS[1]:                         fe80::42:f8ff:fec4:d17d/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

GENERAL.DEVICE:                         br-f16e3c9904f9
GENERAL.TYPE:                           bridge
IP4.ADDRESS[1]:                         172.19.0.1/16
IP4.GATEWAY:                            --
IP4.ROUTE[1]:                           dst = 172.19.0.0/16, nh = 0.0.0.0, mt = 0
IP6.ADDRESS[1]:                         fe80::42:f8ff:fec4:d17d/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

GENERAL.DEVICE:                         br-f16e3c9904f9
GENERAL.TYPE:                           bridge
GENERAL.HWADDR:                         02:42:84:F4:8C:B3
GENERAL.MTU:                            1500
GENERAL.STATE:                          100 (connected (externally))
GENERAL.CONNECTION:                     br-f16e3c9904f9
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/5
IP4.ADDRESS[1]:                         172.21.0.1/16
IP4.GATEWAY:                            --
IP4.ROUTE[1]:                           dst = 172.21.0.0/16, nh = 0.0.0.0, mt = 0
IP6.ADDRESS[1]:                         fe80::42:84ff:fef4:8cb3/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

GENERAL.DEVICE:                         lo
GENERAL.TYPE:                           loopback
GENERAL.HWADDR:                         00:00:00:00:00:00
GENERAL.MTU:                            65536
GENERAL.STATE:                          100 (connected (externally))
GENERAL.CONNECTION:                     lo
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/1
IP4.ADDRESS[1]:                         127.0.0.1/8
IP4.GATEWAY:                            --
IP6.ADDRESS[1]:                         ::1/128
IP6.GATEWAY:                            --

GENERAL.DEVICE:                         br-f499a309d7f1
GENERAL.TYPE:                           bridge
GENERAL.HWADDR:                         02:42:42:3E:38:6C
GENERAL.MTU:                            1500
GENERAL.STATE:                          100 (connected (externally))
GENERAL.CONNECTION:                     br-f499a309d7f1
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/6
IP4.ADDRESS[1]:                         172.27.0.1/16
IP4.GATEWAY:                            --
IP4.ROUTE[1]:                           dst = 172.27.0.0/16, nh = 0.0.0.0, mt = 0
IP6.GATEWAY:                            --

GENERAL.DEVICE:                         docker0
GENERAL.TYPE:                           bridge
GENERAL.HWADDR:                         02:42:34:A0:B8:08
GENERAL.MTU:                            1500
GENERAL.STATE:                          100 (connected (externally))
GENERAL.CONNECTION:                     docker0
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/3
IP4.ADDRESS[1]:                         172.17.0.1/16
IP4.GATEWAY:                            --
IP4.ROUTE[1]:                           dst = 172.17.0.0/16, nh = 0.0.0.0, mt = 0
IP6.GATEWAY:                            --

GENERAL.DEVICE:                         p2p-dev-wlan0
GENERAL.TYPE:                           wifi-p2p
GENERAL.HWADDR:                         (unknown)
GENERAL.MTU:                            0
GENERAL.STATE:                          30 (disconnected)
GENERAL.CONNECTION:                     --
GENERAL.CON-PATH:                       --

GENERAL.DEVICE:                         eth0
GENERAL.TYPE:                           ethernet
GENERAL.HWADDR:                         2C:CF:67:75:9F:B0
GENERAL.MTU:                            1500
GENERAL.STATE:                          20 (unavailable)
GENERAL.CONNECTION:                     --
GENERAL.CON-PATH:                       --
WIRED-PROPERTIES.CARRIER:               off
IP4.GATEWAY:                            --
IP6.GATEWAY:                            --

GENERAL.DEVICE:                         veth2ac1f8d
GENERAL.TYPE:                           ethernet
GENERAL.HWADDR:                         8E:77:04:AA:BA:75
GENERAL.MTU:                            1500
GENERAL.STATE:                          10 (unmanaged)
GENERAL.CONNECTION:                     --
GENERAL.CON-PATH:                       --
WIRED-PROPERTIES.CARRIER:               on
IP4.GATEWAY:                            --
IP6.ADDRESS[1]:                         fe80::8c77:4ff:feaa:ba75/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

GENERAL.DEVICE:                         vetha926f7e
GENERAL.TYPE:                           ethernet
GENERAL.HWADDR:                         C6:A7:F6:79:F4:C9
GENERAL.MTU:                            1500
GENERAL.STATE:                          10 (unmanaged)
GENERAL.CONNECTION:                     --
GENERAL.CON-PATH:                       --
WIRED-PROPERTIES.CARRIER:               on
IP4.GATEWAY:                            --
IP6.ADDRESS[1]:                         fe80::c4a7:f6ff:fe79:f4c9/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

GENERAL.DEVICE:                         vethb25afe0
GENERAL.TYPE:                           ethernet
GENERAL.HWADDR:                         C6:A7:F6:79:F4:C9
GENERAL.MTU:                            1500
GENERAL.STATE:                          10 (unmanaged)
GENERAL.CONNECTION:                     --
GENERAL.CON-PATH:                       --
WIRED-PROPERTIES.CARRIER:               on
IP4.GATEWAY:                            --
IP6.ADDRESS[1]:                         fe80::c4a7:f6ff:fe79:f4c9/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

GENERAL.DEVICE:                         vethb25afe0
GENERAL.TYPE:                           ethernet
GENERAL.HWADDR:                         8E:41:99:AF:BA:B9
GENERAL.MTU:                            1500
GENERAL.STATE:                          10 (unmanaged)
GENERAL.CONNECTION:                     --
GENERAL.CON-PATH:                       --
WIRED-PROPERTIES.CARRIER:               on
IP4.GATEWAY:                            --
IP6.ADDRESS[1]:                         fe80::8c41:99ff:feaf:bab9/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 256

If I connect to the two websites through a VPN that uses external networks, they are reachable. I also tried to input in the address line of the web browser: https://192.168.1.104:5432/ where 5432 is one of the local port of one the server, but Firefox replied with this:

Secure connection failed

An error occurred while connecting to 192.168.1.104:5432. PR_END_OF_FILE_ERROR

Error code: PR_END_OF_FILE_ERROR

The page you are trying to view cannot be displayed because the authenticity of the data received could not be verified.
Please contact the website administrator to inform them of the problem.

The same happens for the other server

What is the issue? How to make servers reachable from everywhere?

Improve this question
New contributor
SPS is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
4
  • Some routers have a feature called "AP isolation" or "Client isolation" that prevents devices on the same Wi-Fi network from communicating with devices on other networks or even other Wi-Fi devices. Check your router's settings and disable AP/Client isolation.
    – liaifat85
    Commented Dec 6 at 13:21
  • I also checked this with the network admin: ibb.co/nn5s3Tj No isolation set
    – SPS
    Commented Dec 6 at 13:58
  • 1
    There is a port forwarding set on the company router for incoming connections to the specific ports. All connections from outside work very well. - simple, enable NAT hairpinning/loopback on those port forwards - then you can use https://myserver1.domainXXX.net from within the LAN
    – Bravo
    Commented Dec 6 at 23:41
  • @Bravo it is enabled on all the ports of the NAT port forwarding. You can see here for one of the port: ibb.co/M9s8cPF But it seems not the solution
    – SPS
    Commented Dec 7 at 11:44

1 Answer 1

Reset to default
1

What is the issue?

WRT the last problem (which seems distinct from the routing issue?), this:

The page you are trying to view cannot be displayed because the authenticity of the data received could not be verified.

You're using https, and presumably the server is using TLS/SSL, but TLS server certificates are issued to specific hosts. 192.168.1.104 is almost certainly not the host name on the certificate (I doubt an actual IP address can be used on the cert, I've never tried, although you can use things like localhost or arbitrary names as long as they can be resolved).

Additionally, if those certs are self-signed or from a private CA, you will have to figure out how to make Firefox respect them since by default it will not. Otherwise it should, but only if the host name used in the location bar matches that in the certificate. Since it seems part of the problem is accessing the servers via that host name because it gets routed through an external IP address (which is probably what DNS resolves it to), you can configure the local system to resolve it to a LAN address.

First check what the address is by trying to ping the host name (this is all on your desktop, not the Pi):

ping myserver.domainX.com

This may or may not work, but it will at least give the IP address (the first line: PING myserver.domainX.com (123.456.789.1) ...) the name resolves to. Presuming that isn't the LAN address, you can then edit /etc/hosts on your desktop to include the line:

 192.168.1.104   myserver.domainX.com

After saving the file it will be applied; try the ping again and see if the IP address has changed (if not, there may be some element of the Ubuntu network services that is interfering, but I do not think so).

Improve this answer
13
  • 1
    Sorry, I clarified that above by adding "on the cert": I was referring to the host name on the cert; TLS certs do not have IP addresses associated with them, they have host names. These can be anything, but the host name must match what you use in the location bar -- since that is then resolved to an IP address, 'localhost' is fine if the server is actually on the local computer, or 'foo.bar' is fine if the local computer or one of its DNS server resolves the host name to the correct address (which could be a LAN address).
    – goldilocks ♦
    Commented Dec 6 at 22:03
  • 1
    ...Which should be easy. It is on linux, just modify /etc/hosts -- but I'm not a Windows or Mac user so you will have to look that up.
    – goldilocks ♦
    Commented Dec 6 at 22:36
  • 1
    I've edited the paragraph starting "Additionally" and put some stuff after that to explain.
    – goldilocks ♦
    Commented Dec 7 at 13:22
  • 1
    If you did exactly what was explained in the last two paragraphs, yes. Did you try the ping after editing /etc/hosts?
    – goldilocks ♦
    Commented Dec 7 at 19:41
  • 1
    No -- that would amount to the server saying, "Look, I know I'm using a cert that belongs to a domain which appears to not be this computer (based on IP), but just trust me...". That is a very significant security issue. Beware that when you do this, all requests to that domain will go to the LAN IP, not just web stuff (since it's the same computer that's probably fine).
    – goldilocks ♦
    Commented 2 days ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.