0

I'm developing a website, which requires an https connection because of the login system.
I opened my Tomcat's Connector on port 443 and connecting through https://localhost works well, but i need it to be accessible from outside (with the public ip address). I went on the router and i opened "port forwarding".
I tried to open port 443, but the router (Fritz!Box7390) says "L'abilitazione porte non si può creare o attivare perché esiste già un'abilitazione porte corrispondente.", which is "Can't open the port 443 because it's already open.".

The problem is that I CAN'T connect to the server, because obviously that port isn't opened and it also isn't present in the Port Forwarding Panel (where I see all the open ports).


I was able to open port 80 when I wasn't needing a more secure way to connect.

How can I open it successfully? I can't find any help on the internet

4
  • Could it be simply that the router itself uses HTTPS?
    – user
    Nov 4 '15 at 17:58
  • @Michael Kjörling What di you mean? Nov 4 '15 at 18:00
  • 3
    You need to change the router's web interface to use some port other than 443 so that 443 is open for use by the connector. If your ISP manages your router, you may be unable to do this because they may use port 443 for management. Nov 4 '15 at 18:20
  • 1
    What David wrote. If the router claims that port 443 is in use, then something is causing it to claim that port 443 is in use. If nothing is visible in the UI, then the most likely culprit is the router itself. (Note that you can run HTTPS just as well on some other port. You just need to specify the port in the URL, like https://www.example.com:4433/some/path would use port 4433 instead of the default.)
    – user
    Nov 4 '15 at 18:24
0

You're developing a website. You want traffic from the Internet, to your public IP address, on TCP port 443, to be handled by the HTTPS server that provides the information from your website.

The (common) problem is that when traffic from the Internet reaches your public IP address, it reaches your modem. Now what you want the modem to do is to receive the traffic from the Internet, but then to forward this traffic to the computer that is running the web server that handles your website. That process is called Port Forwarding.

The suspicion from the comments is that your router is set up to use HTTPS to allow configuration of the router, and that the router is allowing the "outside traffic" (meaning: traffic from the Internet) to configure the router with HTTPS. That feature is typically available as an option, and the feature is turned on somewhat commonly. That will cause a couple of issues, so people are quite right to suggest that this common scenario is a possible issue.

The first issue is that if the router is running "HTTPS server" software that processes the TCP port 443 traffic, and the router responds to the traffic, then that is what happens to the HTTPS traffic. That is not what you want, since what you want is for the HTTPS traffic to be sent to the computer running your web server.

The second issue is that this permits people on the Internet to control your modem. That must be secured. Those of us who are in the know, know that router manufacturers are typically not making routers sufficiently secure from attack, so it is recommended that you never do this at all (if you haven't replaced the router's firmware with something that is custom and more trusted than what the manufacturers release). Even worse, many people who enable that feature never even bother to change the default passwords, so this is a gaping security hole. (That's the second problem with this setup.) The only aspect that lessens that problem is that attackers don't typically find control of home/office routers to be particularly useful to attack, so there is relatively little incentive for the attack to occur. Still, attacks do occur, so it is best not to turn on that vulnerability.

So what should you do? Look in your router for any option related to configuration/administration using HTTPS over the Internet, which some devices might refer to as the WAN. While you're at it, look for any other remote administration options, like HTTP. Turn off all such options that permit access from the WAN. Permitting access from one LAN port is perfectly acceptable, and permitting access from all LAN ports is reasonably acceptable, but permitting access to the WAN is not permitted at all.

Now some people wish to take the security risk of allowing remote administration from the WAN. That might be tolerable if they change the default credentials (password, possibly username too). They should understand the risks if they want to do that. However, they should also understand that doing so will not allow HTTPS traffic on port 443 to be forwarded to an internal machine. Since you do want that traffic forwarded, permitting WAN administration is not an option for your particular goals.

Another option is to have multiple public IP addresses, but that can be costly for IPv4 for many ISPs, and can be more complicated, and is not generally necessary. Most people won't need to go that route unless they want to have multiple HTTPS servers responding to the same TCP port number, which generally isn't the case if you're just setting up a single website. (Thanks to SNI, even multiple websites can often use a single HTTPS server port, making that route unnecessary.)

In theory, at least, there might be other possible causes. However, your comment of "Can't open the port 443 because it's already open." (Thank you for translating that from French for us!) makes it highly likely that the router is using TCP port 443 for something else. If the router provides anything similar to a Unix prompt, you might be able to use some standard command to get more information about just what is using that port. Most likely, you're configuring the router using a web interface (or perhaps specialized software from the vendor), in which case you just need to manually look over the graphical interface, hoping to find the option that is causing the problem. Try looking for options (menus, or screens of options) with names like "Administration". We probably can't get a whole lot more specific unless you provide the router's make (manufacturer) and model number.

1
  • Thanks! Now I'll figure out how to fix it and if I found a solution for my router I will post it on the question. But one more time, thanks to let me figure out what was causing the problem Nov 5 '15 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.