Skip to main content

Question regarding whm server on a nat behind a fortigate

Valorbound Web Studios

I have a whm server behind a fortigate with a 1:1 nat ip, but I notice I am having issues with SSL Certs renewing and the license file.

 

I have all ports open and on autossl in the log I get the error that loopback NAT on this address appears to be defective any suggestions would be greatly appreciated.

Comments

14 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  Details on this one are in the top yellow "Important" box here:

    https://docs.cpanel.net/knowledge-base/general-systems-administration/1-1-nat/

    so you'll likely need to poke your hosting provider to have them ensure that is configured correctly.

    0
  • Valorbound Web Studios

    So yes 1:1 nat appears to be working correctly as I was able to get WHM installed and working, in regards to loopback or hairpin NAT I have full access to the firewall and have configured it according to the documentation.

     

    But one thing I am puzzled about is how to configure loopback/hairpin nat on the server?  I'm using almalinux 9 for the server which is running as a VM on Proxmox, the proxmox firewall is off and for Almalinux I followed all the standard procedures for installing whm server.

     

    In regards to the firewall it is a fortigate firewall I am able to access everything on the server which I assume everything is configured correctly in regards to the firewall, it was only recently I have noticed that I have to repair the license file and the error regarding SSL. 

     

    Other than that websites are working fine that are hosted there, and everything else appears to be working fine in regards to server functionality and access.

    0
  • Valorbound Web Studios

    So I'm digging further and I think it is something within alma linux 10, whm, imunify where hairpin/loopback nat is not working properly, because I'm not seeing anything unusual on the fortigate logs, I even validated that I have all the ports open because as I mentioned I can access everything without an issue.  It's weirdest thing, if anyone has any documentation or information they can provide it would be much appreciated.

    My setup with my provider is as follows

    Server is running promox and it is connected to a fortigate firewall where I have full access to configure my VDOM as I need, on the Proxmox host I am running an almalinux 10 VM which is my WHM server and my whm server running the latest version also has imunify360 installed.

     

    I think what I might do if I can is leverage a demo license of WHM if possible to build another setup from scratch to see if I can figure out what I did wrong and fix it accordingly.

    0
  • Valorbound Web Studios

    After some more research I figured out what iptables rule needs to be applied to the server to make sure loopback/hairpin NAT works.

     

    iptables -t nat -A OUTPUT -d <public IP> -s <iNAT IP or subnet> -j DNAT --to-destination <NAT IP of server>

     

    example: iptables -t nat -A OUTPUT -d 208.15.155.4 -s 192.168.15.0/24 or 192.168.15.75 -j DNAT --to-destination 192.168.15.75

    0
  • Valorbound Web Studios

    I am however having an issue renewing the lets encrypt cert for the WHM Services, when I try to run /usr/local/cpanel/bin/autossl_check --user=root I get the message The cpanel user named "root" does not exist on this system.

    0
  • Valorbound Web Studios

    The last Lets Encrypt cert I see for the server domain name is dated 7/14/26.

    0
  • cPRex Jurassic Moderator

    The SSLs for the services live under a different command:

    /usr/local/cpanel/bin/checkallsslcerts

    and not the root user.  Can you try that and see what results you get?

    0
  • Valorbound Web Studios

    Here is what I get below, also the www.whm-dev are not even in DNS so I don't know where it is getting them from.

    The system will check for the certificate for the “cpanel” service.
    The system will attempt to replace the self-signed certificate for the “cpanel” service with a signed certificate from the “Let’s Encrypt™” provider.
    The system will attempt to install a certificate for the “cpanel” service from the system SSL storage.
    None of the certificates in the system SSL storage were acceptable to use for the “cpanel” service.
    The system will attempt to get a new certificate for the domains: autoconfig.whm-dev.valorboundhosting.com, autodiscover.whm-dev.valorboundhosting.com, cpanel.whm-dev.valorboundhosting.com, cpcalendars.whm-dev.valorboundhosting.com, cpcontacts.whm-dev.valorboundhosting.com, ipv6.whm-dev.valorboundhosting.com, mail.whm-dev.valorboundhosting.com, webdisk.whm-dev.valorboundhosting.com, webmail.whm-dev.valorboundhosting.com, whm-dev.valorboundhosting.com, whm.whm-dev.valorboundhosting.com, www.whm-dev.valorboundhosting.com
    The domain “autoconfig.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “autodiscover.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “cpanel.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “cpcalendars.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “cpcontacts.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “ipv6.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “mail.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “webdisk.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “webmail.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “whm.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The domain “www.whm-dev.valorboundhosting.com” is not suitable for HTTP DCV because the system did not find any A or AAAA records with a public IP address.
    The system failed to validate domain control for the domain “whm-dev.valorboundhosting.com” using the “HTTP” DCV method: Timeout after 30 seconds!
    The domain “autoconfig.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “autodiscover.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “cpanel.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “cpcalendars.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “cpcontacts.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “ipv6.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “mail.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “webdisk.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “webmail.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “whm.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The domain “www.whm-dev.valorboundhosting.com” is not suitable for DNS DCV because this system is not the authoritative nameserver.
    The system will not attempt to get a new certificate from the “Let’s Encrypt™” provider because no suitable domains were found.

    The system will check for the certificate for the “dovecot” service.
    The system will attempt to replace the self-signed certificate for the “dovecot” service with a signed certificate from the “Let’s Encrypt™” provider.
    The system will attempt to install a certificate for the “dovecot” service from the system SSL storage.
    None of the certificates in the system SSL storage were acceptable to use for the “dovecot” service.
    The system previously attempted to get a new certificate from the “Let’s Encrypt™” provider and will not make another attempt.

    The system will check for the certificate for the “exim” service.
    The system will attempt to replace the self-signed certificate for the “exim” service with a signed certificate from the “Let’s Encrypt™” provider.
    The system will attempt to install a certificate for the “exim” service from the system SSL storage.
    None of the certificates in the system SSL storage were acceptable to use for the “exim” service.
    The system previously attempted to get a new certificate from the “Let’s Encrypt™” provider and will not make another attempt.

    The system will check for the certificate for the “ftp” service.
    The system will attempt to replace the self-signed certificate for the “ftp” service with a signed certificate from the “Let’s Encrypt™” provider.
    The system will attempt to install a certificate for the “ftp” service from the system SSL storage.
    None of the certificates in the system SSL storage were acceptable to use for the “ftp” service.
    The system previously attempted to get a new certificate from the “Let’s Encrypt™” provider and will not make another attempt

    0
  • cPRex Jurassic Moderator

    Is it possible that it is pulling a previous hostname that was configured on the server?  Details here would tell you how to adjust that:

    https://support.cpanel.net/hc/en-us/articles/5208055750039-Old-hostname-shows-up-in-new-hostname-certificates

     

    0
  • Valorbound Web Studios

    I already did the procedure of moving the json file and there wasn't any csrs file, but those hostnames are still there, also I don't think it is pulling an old hostname because from what I can tell it was fine up until 7/14.

    0
  • cPRex Jurassic Moderator

    It's odd to me that these records aren't located anywhere in DNS, as if they weren't there wouldn't be a way to process them through the AutoSSL system.

    If you manually grep through /var/named/ on the machine do you still not see those domains listed?  If not, it would be best to create a ticket so this could be examined directly on the server.

    0
  • Valorbound Web Studios
    • Edited

    I will be opening a ticket, because those extra names don't exist.  Ticket ID is 96053716

    0
  • Valorbound Web Studios

    I am curious why support thinks it is a dns server issue when this hasn't happened before and I was able to do the install just fine.

    0
  • cPRex Jurassic Moderator

    I think Vladimir summed it up nicely in the later replies, but let us know if you need anything else.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post