[SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set

Gertjan

If it's a recent change, you could :
Backup the config first.
( quick and dirty method, will do if the system is still accesible using the console : copy it to a save place like /root/... )

Now, use the cheap menu and see what option 15 van do for you.

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

But I need to solve it. ;)

Yeah, guess you went for the red a while ago.

johnpoz

Your going down the wrong rabbit whole - if you have the antilock out rule there, blocking rfc1918 is not preventing you from access the gui.. You have something else going on. Like the gui not even running or working maybe?

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

gui not even running or working maybe?

May be... How to see it in system processes, or by other way ? Because this is Nginx work, right?

johnpoz

@sergei_shablovsky what port is gui listening on?

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: sockstat | grep :8443
root     nginx      61483 6  tcp4   *:8443                *:*
root     nginx      61483 7  tcp6   *:8443                *:*
root     nginx      61230 6  tcp4   *:8443                *:*
root     nginx      61230 7  tcp6   *:8443                *:*
root     nginx      60962 6  tcp4   *:8443                *:*
root     nginx      60962 7  tcp6   *:8443                *:*
[21.05.1-RELEASE][admin@sg4860.local.lan]/root:

You know you can just reset all of that from the console menu, and even just rollback to previous config.

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky what port is gui listening on?

from default pfSense installation, SHTTP

You know you can just reset all of that from the console menu, and even just rollback to previous config.

I know, thank You!
But the SysAdmins that make reinstall from USB memstick (with Restore from config.xml function), cannot save any configs history. :(

johnpoz

@sergei_shablovsky not talking about that - just use the restore config feature from console menu

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky not talking about that - just use the restore config feature from console menu

No any backups exist. Because reinstall by SysAdmin from USB memstick.

Sergei_Shablovsky

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

We move far away from initial post. ;)
Is this help in my situation?

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

what port is gui listening on?
80

And also

sockstat | grep nginx

give me both 80, 443 for tcp4/tcp6

johnpoz

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is this help in my situation?

yes because you have console access.. Roll back - but again, if you have antilock out enabled, doesn't matter if you block rfc1918.. Since the antilockout would allow it before that rule would be evaluated.

stephenw10

If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

Steve

Sergei_Shablovsky

@stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

After several messages we come to my initial question:

Is that possible to using pfSense PHP Shell the command ?

     $config['system']['disablefilter'] = true;

for disabling pf temporarily?

You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

Which exactly line?
(Sorry my stupidness)

Gertjan

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

Sure thing !
The "pfSense PHP Shell" is like a command interpreter.
No ..... it IS a command interpreter. It's PHP.
So, you have to create the 'script' command file, and then execute it.

Is there a 'playback' file already present ?
Probably not.

use these :

Available playback commands:
     changepassword disablecarp disablecarpmaint disabledhcpd disablereferercheck enableallowallwan enablecarp enablecarpmaint enablesshd externalconfiglocator gatewaystatus generateguicert gitsync installpkg listpkg pfanchordrill pfblockerng_install.inc pftabledrill removepkgconfig removeshaper resetwebgui restartallwan restartdhcpd restartipsec svc uninstallpkg

as a how to do example.

stephenw10

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?
     $config['system']['disablefilter'] = true;
for disabling pf temporarily?

Yes but I would not do that. Just run at the command line:

pfctl -d

That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

Which exactly line?

		<lan>
			<if>em1</if>
			<descr><![CDATA[LAN]]></descr>
This one =>		<blockpriv></blockpriv>
			<enable></enable>
			<ipaddr>192.168.1.1</ipaddr>
			<subnet>24</subnet>
		</lan>

Steve

Sergei_Shablovsky

@stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:
Is that possible to using pfSense PHP Shell the command ?
     $config['system']['disablefilter'] = true;
for disabling pf temporarily?
Yes but I would not do that.

Could You be so please to explain why exactly? For risky to damage mails .config file in situation when I have no backup copy of it?

Just run at the command line:
pfctl -d
That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

This enabling access to GUI.
THANK YOU (AND ALL OTHERS HERE!) for suggestions, help and teaching!

Which exactly line?

		<lan>
			<if>em1</if>
			<descr><![CDATA[LAN]]></descr>
This one =>		<blockpriv></blockpriv>
			<enable></enable>
			<ipaddr>192.168.1.1</ipaddr>
			<subnet>24</subnet>
		</lan>

Thank You for explain and patience!
Interesting for ma, place in bookmarks;)

Sergei_Shablovsky

May be is would be great to add a page “What to to if You cannot access the pfSense GUI?” in “Troubleshooting” section of official docs?

I more than sure that on the way the pfSense become more and more poplar, then more frequently the situation like this happened because lack of user experience. This looks like logical.

This page may consist of:

try to rollback to backup copy of configuration from remote/local console, using
ensure that nginx running and on which port by netstat and
temporary disable pf
make restoring from remote backup
enable pf
check all working ok

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

You can hand the gun on safe, with no bullets even. And users still manage to shoot themselves in the foot ;)

This “Restoring ...” May be helpful, because each time users would be try to “shoot themsefs”. ;)

stephenw10

A lot of that is already covered here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

Steve

Sergei_Shablovsky

@stephenw10 said in [SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set:

A lot of that is already covered here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

Steve
Thank You, sorry my lack of expired with official docs. ;)

It anyway, thus certain case (when a SysAdmin check the “Block LAN addresses” and save preferences), not covered in this document.

For example most close to this are Blocked Access with Firewall Rules, but not exactly the same.

johnpoz

@sergei_shablovsky What exactly are the rule(s) they enabled. Because I still do not get what the issue is here. When asked if they also disabled the antilock out you stated no.

It is not possible to block your lan network from accessing the gui with the antilock out rule there - that is the whole point of it!!

Sure you can block internet access, and you could block dns doing that - but access to the pfsense lan IP on the gui or ssh port would still be allowed by the antilock out..