No web gui after updating 24.03
-
I have updated my pfsense + to 24.03 and now i can't see the webgui login page. MV (Proxmox) is working because wireguard vpn tunnels are connecting well but i can't see anything on the webrowser. No ping, nothing on 8001 port..
I'll stay on 23.09 for now..
What is the problem?
Thanks. -
Does it show an errors at the console in Proxmox?
Can you SSH to it?
Steve
-
@stephenw10 Nope.. no errors... all shows well, ips, configurations, all ok.
I have 5 wireguards tunnels and all works. I mean, MV is working but i can't login anymore.
I have another VM with pfsense+ and no problem updating.
This MV is only for wireguard.. it's very simple.. no suricata, no PFblocker..I'll do what you say... what can i do now? i have restored my 23.09 MV 6 times...
Thanks Stephen -
@stephenw10 Another data... when update "echo request" AKA ping is no longer available. I don't know why, but... no ping after updating.
This is my image whe update:
This is my dashboard (Very simple)
After updating:
PD: NO SSH connection after update... before updating working like a charm...
No errors in proxmox:
-
I'd expect that to upgrade fine. Does it never come back after that?
What does the console show?
-
@stephenw10
The console show this...
-
The IP addresses are still correct?
Can you ping out from the console?
You might be hitting the firewall state binding change:
https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#generalHow are you trying to connect to the webgui?
-
@stephenw10 said in No web gui after updating 24.03:
https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#general
Yes.. i try to connect to web GUI, but nothing.. no ping, no ssh, no webgui...
I try to connect to webgui with IP (Firefox, Brave, chrome...) but nothing..Yes, i can pint out from console on proxmox.
After test a few ideas... that vpn-pfsense are working.. if i connect with a wireguard vpn and try to enter the pfsnse MV says "Connection REFUSED" in other words.. firewall inside that MV is working..
but.. why i can't see the webgui? This pfsense have been working more than 1 year without problems...
0 errors or problems while loading pfsense+
-
@stephenw10 said in No web gui after updating 24.03:
You might be hitting the firewall state binding change:
https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#generalHow are you trying to connect to the webgui?
That ^.
If you have some sort of route asymmetry it may be blocking the traffic.
If you disable the firewall as a test can you connect?
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall -
@stephenw10
WORKING...
I put a all traffic passing from wireguard connection and i can login into pfnsense, and go to advanced--firewall & nat and floating states...How to configure the more secure Interface Bound States?
-
The fact it blocked your connection with Interface Bound States set implies the traffic was taking an unexpected route somehow.
You first need to work out what was happening there and resolve it.
Or you can set the binding policy to floating on only the rules required to reach the webgui.
I would connect to it and then check the state table to see where the connection is actually opening states. I'm still not clear how you were trying to access it before that was broken.
-
I don't quite understand what's going on since on my other two virtual machines I haven't touched anything and the “Interface Bound States” configuration has worked without doing anything.
What should I do to activate Interface Bound States without the firewall preventing me from accessing the web?
Now I have it on “Floating States” and everything works as usual but I read that it is less secure.
What are the steps to activate Interface Bound States without the firewall blocking me?
I can enter the VM via WAN or LAN.
The Pfsense VM it's inside a lan where the router is another Pfsense that's the reason why i can enter by WAN and LAN
-
@stephenw10
After a few hours testing.. now i can say that i understand where de failure was. If your pass rule is in "Floating rule" when update the firewall will block you because by default update change the metod to Interface Bound States. You must introduce pass rule inside interface tab... that's easy :)All working now.
Thanks Stephenw10 -
@wisepds said in No web gui after updating 24.03:
If your pass rule is in "Floating rule" when update the firewall will block you because by default update change the metod to Interface Bound States
Huh, that might be worth a comment in the release notes...?
-
Hmm, because your floating rule was applied to multiple interfaces? Or was outbound or some other advanced firewall option?
-
@wisepds said in No web gui after updating 24.03:
You must introduce pass rule inside interface tab.
Okay. Same issue here. My configuration was very basic from the beginning purchase of netgate 3100 with no custom rules. How to introduce pass rule without the GUI?
-
@4eanlss there are a handful of suggestions on https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#remotely-circumvent-firewall-lockout-with-rules.
However the default pfSense config is no floating rules and an allow all rule on LAN.
-
Yes still unclear exactly what the floating rule configuration was that failed here. I was unable to replicate it locally. I'd love to know what it was because, I agree, we should document it.
-
@stephenw10 I don't know why.. on floating roules only was "PFblocker" floating rules... i only know that with floating rules all work as intend and when we changed to interface bound States GUI stop working.. i must disable firewall and create this rule to work:
My last rule was * * * * * * * and don't work to access.. when that rule was deleted and create a specifically rule to pass.. all work..
That MV is inside a lan.. in other words.. i access that MV by WAN connexion.
-
Hmm, so just the existence of those floating rules prevented access?
The floating rules created by pfBlocker could well block access from the WAN. It coukld just be the pfBlocker lists pulled in something that blocked your local source IP.
