Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 5 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Sergei_Shablovsky
      last edited by

      @sergei_shablovsky what port is gui listening on?

      [21.05.1-RELEASE][admin@sg4860.local.lan]/root: sockstat | grep :8443
      root     nginx      61483 6  tcp4   *:8443                *:*
      root     nginx      61483 7  tcp6   *:8443                *:*
      root     nginx      61230 6  tcp4   *:8443                *:*
      root     nginx      61230 7  tcp6   *:8443                *:*
      root     nginx      60962 6  tcp4   *:8443                *:*
      root     nginx      60962 7  tcp6   *:8443                *:*
      [21.05.1-RELEASE][admin@sg4860.local.lan]/root: 
      

      You know you can just reset all of that from the console menu, and even just rollback to previous config.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      Sergei_ShablovskyS 2 Replies Last reply Reply Quote 1
      • Sergei_ShablovskyS
        Sergei_Shablovsky @johnpoz
        last edited by

        @johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

        @sergei_shablovsky what port is gui listening on?

        from default pfSense installation, SHTTP

        You know you can just reset all of that from the console menu, and even just rollback to previous config.

        I know, thank You!
        But the SysAdmins that make reinstall from USB memstick (with Restore from config.xml function), cannot save any configs history. :(

        —
        CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
        Help Ukraine to resist, save civilians people’s lives !
        (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Sergei_Shablovsky
          last edited by

          @sergei_shablovsky not talking about that - just use the restore config feature from console menu

          configs.jpg

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          Sergei_ShablovskyS 1 Reply Last reply Reply Quote 0
          • Sergei_ShablovskyS
            Sergei_Shablovsky @johnpoz
            last edited by Sergei_Shablovsky

            @johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

            @sergei_shablovsky not talking about that - just use the restore config feature from console menu

            No any backups exist. Because reinstall by SysAdmin from USB memstick.

            —
            CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
            Help Ukraine to resist, save civilians people’s lives !
            (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

            1 Reply Last reply Reply Quote 0
            • Sergei_ShablovskyS
              Sergei_Shablovsky @Sergei_Shablovsky
              last edited by

              @sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

              Is that possible to using pfSense PHP Shell the command ?

              We move far away from initial post. ;)
              Is this help in my situation?

              —
              CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
              Help Ukraine to resist, save civilians people’s lives !
              (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

              johnpozJ 1 Reply Last reply Reply Quote 0
              • Sergei_ShablovskyS
                Sergei_Shablovsky @johnpoz
                last edited by Sergei_Shablovsky

                @johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                what port is gui listening on?
                80

                And also

                sockstat | grep nginx
                

                give me both 80, 443 for tcp4/tcp6

                —
                CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
                Help Ukraine to resist, save civilians people’s lives !
                (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Sergei_Shablovsky
                  last edited by

                  @sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                  Is this help in my situation?

                  yes because you have console access.. Roll back - but again, if you have antilock out enabled, doesn't matter if you block rfc1918.. Since the antilockout would allow it before that rule would be evaluated.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 1
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

                    You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

                    Steve

                    Sergei_ShablovskyS 1 Reply Last reply Reply Quote 1
                    • Sergei_ShablovskyS
                      Sergei_Shablovsky @stephenw10
                      last edited by Sergei_Shablovsky

                      @stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                      If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

                      After several messages we come to my initial question:

                      Is that possible to using pfSense PHP Shell the command ?

                           $config['system']['disablefilter'] = true;
                      

                      for disabling pf temporarily?

                      You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

                      Which exactly line?
                      (Sorry my stupidness)

                      —
                      CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
                      Help Ukraine to resist, save civilians people’s lives !
                      (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

                      GertjanG stephenw10S 2 Replies Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @Sergei_Shablovsky
                        last edited by

                        @sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                        Is that possible to using pfSense PHP Shell the command ?

                        Sure thing !
                        The "pfSense PHP Shell" is like a command interpreter.
                        No ..... it IS a command interpreter. It's PHP.
                        So, you have to create the 'script' command file, and then execute it.

                        Is there a 'playback' file already present ?
                        Probably not.

                        use these :

                        Available playback commands:
                             changepassword disablecarp disablecarpmaint disabledhcpd disablereferercheck enableallowallwan enablecarp enablecarpmaint enablesshd externalconfiglocator gatewaystatus generateguicert gitsync installpkg listpkg pfanchordrill pfblockerng_install.inc pftabledrill removepkgconfig removeshaper resetwebgui restartallwan restartdhcpd restartipsec svc uninstallpkg
                        

                        as a how to do example.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 1
                        • stephenw10S
                          stephenw10 Netgate Administrator @Sergei_Shablovsky
                          last edited by

                          @sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                          Is that possible to using pfSense PHP Shell the command ?

                               $config['system']['disablefilter'] = true;
                          

                          for disabling pf temporarily?

                          Yes but I would not do that. Just run at the command line:

                          pfctl -d
                          

                          That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

                          Which exactly line?

                          		<lan>
                          			<if>em1</if>
                          			<descr><![CDATA[LAN]]></descr>
                          This one =>		<blockpriv></blockpriv>
                          			<enable></enable>
                          			<ipaddr>192.168.1.1</ipaddr>
                          			<subnet>24</subnet>
                          		</lan>
                          

                          Steve

                          Sergei_ShablovskyS 1 Reply Last reply Reply Quote 2
                          • Sergei_ShablovskyS
                            Sergei_Shablovsky @stephenw10
                            last edited by

                            @stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                            @sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                            Is that possible to using pfSense PHP Shell the command ?

                                 $config['system']['disablefilter'] = true;
                            

                            for disabling pf temporarily?

                            Yes but I would not do that.

                            Could You be so please to explain why exactly? For risky to damage mails .config file in situation when I have no backup copy of it?

                            Just run at the command line:

                            pfctl -d
                            

                            That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

                            This enabling access to GUI.
                            THANK YOU (AND ALL OTHERS HERE!) for suggestions, help and teaching!

                            Which exactly line?

                            		<lan>
                            			<if>em1</if>
                            			<descr><![CDATA[LAN]]></descr>
                            This one =>		<blockpriv></blockpriv>
                            			<enable></enable>
                            			<ipaddr>192.168.1.1</ipaddr>
                            			<subnet>24</subnet>
                            		</lan>
                            

                            Thank You for explain and patience!
                            Interesting for ma, place in bookmarks;)

                            —
                            CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
                            Help Ukraine to resist, save civilians people’s lives !
                            (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

                            Sergei_ShablovskyS 1 Reply Last reply Reply Quote 0
                            • Sergei_ShablovskyS
                              Sergei_Shablovsky @Sergei_Shablovsky
                              last edited by

                              May be is would be great to add a page “What to to if You cannot access the pfSense GUI?” in “Troubleshooting” section of official docs?

                              I more than sure that on the way the pfSense become more and more poplar, then more frequently the situation like this happened because lack of user experience. This looks like logical.

                              This page may consist of:

                              • try to rollback to backup copy of configuration from remote/local console, using
                              • ensure that nginx running and on which port by netstat and
                              • temporary disable pf
                              • make restoring from remote backup
                              • enable pf
                              • check all working ok

                              —
                              CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
                              Help Ukraine to resist, save civilians people’s lives !
                              (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

                              1 Reply Last reply Reply Quote 0
                              • Sergei_ShablovskyS
                                Sergei_Shablovsky @johnpoz
                                last edited by

                                @johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

                                You can hand the gun on safe, with no bullets even. And users still manage to shoot themselves in the foot ;)

                                This “Restoring ...” May be helpful, because each time users would be try to “shoot themsefs”. ;)

                                —
                                CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
                                Help Ukraine to resist, save civilians people’s lives !
                                (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  A lot of that is already covered here:
                                  https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

                                  Steve

                                  Sergei_ShablovskyS 1 Reply Last reply Reply Quote 0
                                  • Sergei_ShablovskyS
                                    Sergei_Shablovsky @stephenw10
                                    last edited by Sergei_Shablovsky

                                    @stephenw10 said in [SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set:

                                    A lot of that is already covered here:
                                    https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

                                    Steve
                                    Thank You, sorry my lack of expired with official docs. ;)

                                    It anyway, thus certain case (when a SysAdmin check the “Block LAN addresses” and save preferences), not covered in this document.

                                    For example most close to this are Blocked Access with Firewall Rules, but not exactly the same.

                                    —
                                    CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
                                    Help Ukraine to resist, save civilians people’s lives !
                                    (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Sergei_Shablovsky
                                      last edited by johnpoz

                                      @sergei_shablovsky What exactly are the rule(s) they enabled. Because I still do not get what the issue is here. When asked if they also disabled the antilock out you stated no.

                                      It is not possible to block your lan network from accessing the gui with the antilock out rule there - that is the whole point of it!!

                                      Sure you can block internet access, and you could block dns doing that - but access to the pfsense lan IP on the gui or ssh port would still be allowed by the antilock out..

                                      firstrule.jpg

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.