Web Service Connection Reset

support
1

Hi,

I setuped a new host to use over tunnel and I configured SSH and Web service, SSH works fine but Web I received connection reset.

I already check ferrumgate server → to host on web port using curl and is OK, I already review authorization and is OK, have any log to verify this issue?

Thanks in advance.

2

Please ping web service from client.(ping servicename) İf it works
Check service target ip and port is correct
Then check authorization rules

After that also you could check logs from web page, it shows what is happening

3

Hi,

The communication is OK, I can ping and on web server logs show access try, but the connection always reset.

4

Please type on ferrumgate server
tcpdump -i any -nn port portofservice

Follow RST flag, who is sending first

5

Hi,

The first RST was sent from ferrum IP, not ferrum server, apparently docker address used by ferrum.

6

Then it should be a authorization problem. Please check rules

7

Hi threre,

I reviwed the rule and everything is OK, to access the server over SSH is OK, but attempting open web service not ok.

image
image478×650 12.2 KB

8

This log shows that, proxy service allows to the destinationationweb service. please call web service on ferrumgate server with curl command verbose

9

admin@ip-XX-XX-X-XX:~$ curl --insecure -v https://X.X.X.X:X

  • Trying X.X.X.X:X…
  • Connected to X.X.X.X (X.X.X.X) port X (#0)
  • ALPN: offers h2,http/1.1
  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • TLSv1.3 (IN), TLS handshake, Server hello (2):
  • TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  • TLSv1.3 (IN), TLS handshake, Certificate (11):
  • TLSv1.3 (IN), TLS handshake, CERT verify (15):
  • TLSv1.3 (IN), TLS handshake, Finished (20):
  • TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
  • TLSv1.3 (OUT), TLS handshake, Finished (20):
  • SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
  • ALPN: server did not agree on a protocol. Uses default.
  • Server certificate:
  • subject: O=; OU=; L=New York; C=US; ST=NY; CN=
  • start date: Mar 10 18:43:31 2025 GMT
  • expire date: Mar 9 18:43:31 2029 GMT
  • issuer: O=; OU=; L=New York; C=US; ST=NY; CN=
  • SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
  • using HTTP/1.x

GET / HTTP/1.1
Host: X.X.X.X:X
User-Agent: curl/7.88.1
Accept: /

  • TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  • TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  • old SSL session ID is stale, removing
    < HTTP/1.1 200 OK
    < Cache-Control: must-revalidate
    < X-Frame-Options: DENY
    < Content-Type: text/html
    < ETag: 648f9856fb742fd1ad80a4e90e544995
    < Connection: close
    < X-XSS-Protection: 1; mode=block
    < Server: WWW
    < Date: Wed, 23 Apr 2025 12:40:10 GMT
    < X-Content-Type-Options: nosniff
    < Content-Length: 1217
    < Content-Security-Policy: upgrade-insecure-requests; block-all-mixed-content; form-action ‘self’; frame-ancestors ‘none’; frame-src https://.com; default-src ‘self’; connect-src ‘self’ .com; script-src ‘self’ .com; img-src ‘self’ data:; style-src ‘self’ .com; object-src ‘none’; base-uri ‘self’;
    < Strict-Transport-Security: max-age=31536000; includeSubDomains
    < Expect-CT: max-age=0
    <
* Closing connection 0 * TLSv1.3 (OUT), TLS alert, close notify (256): admin@ip-XX-XX-X-XX:~$
10

Please do the same thing on your client after connected to ferrumgate like curl https://ferrumgateservicename:port

11

C:>curl --insecure -v https://server:port

  • Host server:port was resolved.
  • IPv6: (none)
  • IPv4: 172.XX.XX.XX
  • Trying 172.XX.XX.XX:port…
  • schannel: disabled automatic use of client certificate
  • ALPN: curl offers http/1.1
  • ALPN: server did not agree on a protocol. Uses default.
  • Connected to nessus (172.XX.XX.XX) port p
  • using HTTP/1.x

GET / HTTP/1.1
Host: server:port
User-Agent: curl/8.11.1
Accept: /

  • Request completely sent off
  • schannel: remote party requests renegotiation
  • schannel: renegotiating SSL/TLS connection
  • schannel: SSL/TLS connection renegotiated
  • Recv failure: Connection was reset
  • schannel: recv returned CURLE_RECV_ERROR
  • closing connection #0
    curl: (56) Recv failure: Connection was reset