Forwarding HTTPS

RouterOS Forwarding Protocols
1

Hi all,

I am having a problem forwarding all websites to one website. Http works fine but https does not. Below if my config export:

/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=dhcp_pool1 ranges=192.168.8.10-192.168.8.254
/ip dhcp-server
add address-pool=dhcp_pool1 authoritative=after-2sec-delay disabled=no
interface=ether2 lease-time=3d name=dhcp1
/ip address
add address=192.168.8.1/24 interface=ether2 network=192.168.8.0
add address=192.168.1.2/24 disabled=yes interface=ether1 network=192.168.1.0
/ip dhcp-server lease
add address=192.168.8.2 client-id=1:f0:9f:c2:d0:19:d0 comment=“UniFi Mesh AP”
mac-address=F0:9F:C2:D0:19:D0 server=dhcp1
/ip dhcp-server network
add address=192.168.8.0/24 dns-server=192.168.8.1 gateway=192.168.8.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall nat
add action=masquerade chain=srcnat
add action=redirect chain=dstnat dst-port=443 protocol=tcp to-ports=8080
add action=redirect chain=dstnat dst-port=80 protocol=tcp to-ports=8080
/ip proxy
set cache-path=web-proxy1 enabled=yes
/ip proxy access
add dst-host=www.bills.express
add action=deny dst-host=* redirect-to=www.bills.express
add action=deny dst-host=facebook.com redirect-to=www.bills.express
add action=deny dst-host=www.facebook.com redirect-to=www.bills.express
/ip route
add distance=1 gateway=192.168.1.1
/system clock
set time-zone-name=Africa/Harare
/system identity
set name=“Bills Express”

If I enable the 443 rule under NAT no websites forward correctly, the page just times out. If I disable it then the http traffic is redirected correctly but not https. Please help me figure out where I’ve gone wrong because I’m clearly missing something.

Thanks in advance!

2

If redirecting port 80 http to port 8080 works, it means you have http server on port 8080. If you redirect https to same port, it can’t work, because client will talk https, while server expects http. There’s also another reason why it won’t work even if you had https server on different port and redirected 443 there, and that’s certificate, you can’t get one that would be valid for any hostname and trusted by all clients.

3

Thank you for the info! So what are my options? Can I block all https traffic and only allow my website (which is also https)? And how could I do that?

4

Probably yes. Don’t redirect port 443, and instead in “/ip firewall filter” allow access to :443 and block everything else going to 443.