MX100 – How to forward ports 80/443 to internal Nginx without breaking VPN

[ViniciusCaetano]

Hi everyone,

I have an MX100 where the default VPN port is 443. I need to forward ports 80 and 443 to an internal Nginx server, but I want to avoid any impact on the VPN connection.

What would be the recommended way to configure this on the MX?

• Is it possible to change the VPN port in order to free up 443 for Nginx?

• Or is there a way to keep the VPN running on 443 and still publish Nginx internally?

The goal is to expose a web service hosted on an internal machine, while preserving VPN stability.

Thanks in advance for any guidance.

[rhbirkelund]

I am not sure if you can forward 443 to your nginx server if it is also being used for VPN. You could try and see if the MX picks up the VPN, before forwarding traffic to nginx. 

Otherwise you'll need to change the AnyConnect VPN port to something other than 443. This can be done on the Client VPN page. 

[ViniciusCaetano]

I thought about changing the VPN port to another one, like 4430, and then forwarding all traffic on 80/443 to my Nginx server. Is that possible? I’m concerned it might break something.

[rhbirkelund · Accepted solution]

That should be possible. Usually I go with 8443. 

The users will have to explicitly enter the port when using VPN, if you change it to something different from 443. E.g. they'ææ have to enter vpn.acme.org:8443 in the VPN client. Also, if they have a certain VPN profile installed on their computers, that'll have to change aswell. But, other than that, it should be Okay.