Unable to Access WebConfigurator UI and Unable to SSH into pfsense
-
@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:
The reason for each of the 7 most recent backups that I could see on the screen is "pfblockerNG: saving Unbound custom options". This leads me to suspect there might be something wonky going on with pfblockerNG
Pretty sure it saves a new config every time an update runs. (I would think, because it's regenerating rules)
-
@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:
We use only one ISP so one gateway.
Talking about your lan side rules, do you have say your wan_dhcp selected?
example..
See where the gateway is called out - that would be policy routing.
-
I don't believe we manipulate the gateway address in that fashion.
-
@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:
I don't believe
Prob behoove you to double check, you never know what gets set sometime - I agree normally you wouldn't have this set unless you had a specific reason. But you would be surprised how many posts end up being they are doing PBR is the cause they can't get some other vlan, etc.
And even if you were doing it, it shouldn't prevent access with antilock which would be evaluated first.
-
@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:
https://imgur.com/a/fgXHIEx
Yes that shows the anti-lockout rules are present on LAN. But also that they have passed nothing; 0 bytes/packets/states.
So either some other rule is passing them. Somehow. Or maybe the traffic never reaches pfSense. Or perhaps it's being forwarded.
You could try running a tcpdump from the CLI while you try to connect to confirm it's at least trying.
-
@stephenw10 said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:
CLI while you try to connect to confirm it's at least trying
could be sending it to something else.. sniff is yeah what I would do - have access to console, sniff on pfsense itself to validate traffic gets there.
-
About a week ago, I decided to reset the pfSense firewall to factory defaults from the console menu and left it running without changing any configuration options aside from setting the WAN/LAN interfaces, modifying the console dashboard and creating a DHCP server IP address range. Everything else was left as is.
I was able to access the Web GUI for a couple days. Just 2 days ago, I discovered I could not access it nor could I ssh into it!
Restarting the Web Configurator does not allow me to access the firewall web site.
Executing
pfctl -vvsr | grep -A 4 antishows this:
https://imgur.com/a/J2mbVCxTried running:
#easyrule pass lan tcp <my computer IP addr> <firewall LAN addr> 443and it states the rule was successfully created. However, I cannot access the LAN address of the firewall nor could I ping it from the computer IP address. Tried it from another computer with similar results.Did a
zpool scrub pfSenseand did not indicate any errors.Every system on the LAN side can access the Internet normally-- including our Samsung TV sets and an Enphase IoT device among others.
This is on an older Protectli FW6C purchased in 2021. https://protectli.com/wp-content/uploads/2019/01/FW6C-Datasheet-190104.pdf
At this point, I am not sure what else to do aside from reformatting the drive and starting all over again. Please advise.
-
@dougs and no simple tcpdump?
You could have no rules and completely wide open, still never works if your traffic never gets there..
Your anti lock rule is there.. don't show any states.. Do a simple tcpdump when you try and get there..
-
Mmm, that sure starts to look like it's just not hitting pfSense at all.
-
@stephenw10 said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:
Mmm, that sure starts to look like it's just not hitting pfSense at all.
Yes, sounds like possibly a bad cable...
-
Since traffic can still reach external sites I'd say more likely a rogue dhcp server.
