Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No web gui after updating 24.03

    Scheduled Pinned Locked Moved General pfSense Questions
    56 Posts 9 Posters 5.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 4
      4eanlss @johnpoz
      last edited by

      @johnpoz I was referring to the troubleshooting option to "Add an allow all WAN rule from the shell"; however, if I attempt to load my public IP address (https) I instead get a web page for a login of my ISP devices. Maybe I misunderstand what the troubleshooting was indicating to attempt. Regardless, I've compared all my configuration backups xmls and have not found a anit-lockout rule in any from the beginning; so, not sure if a ever had a valid configuration other than I was able to use the GUI interface 4 years until the upgrade.

      johnpozJ 1 Reply Last reply Reply Quote 0
      • 4
        4eanlss @stephenw10
        last edited by

        @stephenw10 Since my router is functioning normally in all other regards I'm not that concern at this time. I will become familiar with the console interface and attempt to identify the differences in my configuration before/after the upgrade and post results here.

        My configuration only runs two additional services: pfBlockerNG and UPS.
        My procedure was:

        1. Shutdown the system from the GUI menu.
        2. After confirming the system was shutdown, pulled power.
        3. Pulled the USB from UPS and replace batteries. Note: intent was to do UPS maintenance as well and did not want a forced shutdown by UPS during upgrade.
        4. Restarted firewall, confirmed all services were working sans UPS (USB still unplugged).
        5. Made configuration backup.
        6. Performed an upgrade from GUI.
        7. After device restarted and after 10-15 minutes of no response from GUI -- realization that GUI access was blocked; however, firewall was allowing inbound/outbound traffic as expected.
        1 Reply Last reply Reply Quote 1
        • P
          planetinse @wisepds
          last edited by planetinse

          @wisepds same issue for me webgui not responding after upgrade, but everything is up and running.

          Edit: yes for me it was the interface bound state change, after set it to floating - it works again.

          Bob.DigB W 2 Replies Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @planetinse
            last edited by

            @planetinse said in No web gui after updating 24.03:

            Edit: yes for me it was the interface bound state change, after set it to floating - it works again.

            So you have asymmetric routing going on, maybe fix it.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes, it would be good to know exactly what scenarios are hitting that issue. Especially if it's something unexpected. The more we can add to the docs the better.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @4eanlss
                last edited by johnpoz

                @4eanlss said in No web gui after updating 24.03:

                I instead get a web page for a login of my ISP devices.

                Sounds like your behind a double nat, or your doing something with nat reflection and trying to access your public IP from the lan side which is really on your isp device..

                I find it highly unlikely that someone out on the internet going to your IP would end up hitting some upstream isp equipment webgui along the path to your IP webgui. Your local isp equipment with your actual public IP on, sure that would make sense.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                R 4 2 Replies Last reply Reply Quote 1
                • R
                  rbron01 @johnpoz
                  last edited by

                  @johnpoz

                  I have the same problem when I update to the latest version.

                  It finished normal but never comes the console back.

                  I have a simple connection ISP-FW-LAN Port-PC.
                  I can log into the fw with simply opening a shell.

                  Nothing in the logs to be found. I also saw that the LE CA's are gone.
                  My certificates are there but not the CA's. Could this also be the root cause of the issue?

                  johnpozJ 1 Reply Last reply Reply Quote 1
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @rbron01
                    last edited by

                    @rbron01 So your using LE for your webgui?

                    What exactly happens - does it just spin and spin in your browser and then say timeout, what error happens in your browser - does it just show a white page?

                    If you have console or ssh access, just reset the the gui to default listening on 80 without any ssl, does it work then?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      rbron01 @johnpoz
                      last edited by

                      @johnpoz

                      When the update finished it says reloading in xx seconds.

                      Then when i start a new tab it starts spinning and gives a timeout

                      Did not try to do a port 80

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @rbron01
                        last edited by

                        @rbron01 yeah if you run into any sort of craziness with the web gui, you should always be able to fall back to just basic port 80.. I believe its after you reset your webgui password, it asks if you want to fall back to 80.. I think it also asks that if you from the console change your lan IP, which you could just change to whatever it is currently, etc.

                        Been a while since actually used or played with those options.. Could fire up my VM and see, not in the mood to try and reset my actual webgui ;)

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          rbron01 @johnpoz
                          last edited by

                          @johnpoz Changed from HTTPS to HTTP and the port to 80

                          Done an upgrade and as usual no more Webgui

                          It started and is doing traffice but nothing else

                          johnpozJ lohphatL 2 Replies Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @rbron01
                            last edited by

                            @rbron01 is there any way you could be running into the bound to interface change in states vs floating.. Your just hitting pfsense lan IP from device on your lan right..

                            Are you doing anything with policy routing or vpn client or ipsec connections?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              rbron01 @johnpoz
                              last edited by rbron01

                              @johnpoz I have no policy routing nor vpn/ipsec stuff.

                              Just plane in out traffic.

                              Also get a timeout when trying,

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @rbron01
                                last edited by

                                @rbron01 do you show your webgui even running?

                                [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: netstat -an | grep .8443
                                tcp6       0      0 *.8443                 *.*                    LISTEN     
                                tcp4       0      0 *.8443                 *.*                    LISTEN     
                                [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: 
                                

                                Mine listens on 8443.. Since you reset to 80 you should see it listening on 80

                                you should see nginx running on your port

                                [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: sockstat | grep :8443
                                root     nginx      23204 5   tcp4   *:8443                *:*
                                root     nginx      23204 6   tcp6   *:8443                *:*
                                root     nginx      22940 5   tcp4   *:8443                *:*
                                root     nginx      22940 6   tcp6   *:8443                *:*
                                root     nginx      22793 5   tcp4   *:8443                *:*
                                root     nginx      22793 6   tcp6   *:8443                *:*
                                [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: 
                                

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  rbron01 @johnpoz
                                  last edited by

                                  @johnpoz
                                  Got the same but then with port 80

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @rbron01
                                    last edited by johnpoz

                                    @rbron01 you don't have the antilock out rule disabled do you and some rule that would block? Or didn't put the blockrfc/bogon on your lan interface?

                                    When your consoled/ssh in, if you run a curl to say loopback, do you get the page?

                                    curl http://127.0.0.1

                                    if I tell curl to just don't care about trusting the ssl, i get this for example

                                    [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: curl --insecure https://127.0.0.1:8443
                                    <!DOCTYPE html>
                                    <html lang="en">
                                            <head>
                                                    <meta name="viewport" content="width=device-width, initial-scale=1">
                                                <link rel="stylesheet" href="/vendor/bootstrap/css/bootstrap.min.css" type="text/css">
                                                <link rel="stylesheet" href="/css/login.css?v=1701893452" type="text/css">
                                                    <title>sg4860 - Login</title>
                                                    <script type="text/javascript">
                                                            //<![CDATA{
                                                            var events = events || [];
                                                            //]]>
                                                    </script>
                                            <script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script><script type="text/javascript">var csrfMagicToken = "sid:28ec30f520e1d8cf9085d5f5bd6398cca1521f01,1714682436;ip:9e433f3ab86fa2f558df408437777ed99de1cad1,1714682436";var csrfMagicName = "__csrf_magic";</script><script src="/csrf/csrf-magic.js" type="text/javascript"></script></head>
                                    
                                            <body id="login" >
                                                    <div id="total">
                                                            <header>
                                                                    <div id="headerrow">
                                                                            <div class="row">
                                                                                    <!-- Header left logo box -->
                                                                                    <div class="col-sm-4">
                                    

                                    If that is working, that says hey httpd is serving up the page, but for some reason your client is not getting there, it for sure is listening for example.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      rbron01 @johnpoz
                                      last edited by

                                      @johnpoz
                                      I get a page back. However when I connect direct a laptop on the port nothing happens only the timeout

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @rbron01
                                        last edited by johnpoz

                                        @rbron01 hmmm that really points to a problem with rules then.. If you try your IP in that curl command you still get a page right..

                                        For grins I would change the state to floating mode vs interface binding. And you have not rules in floating, and lan rules are just the the default any any?

                                        When you connect a laptop to the port, you get an IP right, your not doing anything with vlans were your tagging stuff. You can ping through on the laptop to the internet, you can ping your lan IP, that sort of thing.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        R 1 Reply Last reply Reply Quote 0
                                        • R
                                          rbron01 @johnpoz
                                          last edited by rbron01

                                          @johnpoz

                                          When i do curl http://10.10.1.1 it comes up with the page

                                          I do not have vlan or taggings.
                                          No rules in floating but I have rules on LAN but these are the std blocking stuff between different networks. I have WAN, LAN and IOT.

                                          Tomorrow I will do some more testing now going to bed :)

                                          I will role it back and make a screenshot of the LAN rules for you.
                                          Anything else you may want to have a screenshot off?

                                          Thanks for your great help :)

                                          johnpozJ 2 Replies Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @rbron01
                                            last edited by

                                            @rbron01 said in No web gui after updating 24.03:

                                            but I have rules on LAN but these are the std blocking stuff between different networks

                                            Wouldn't matter if you had zero rules - as long as you didn't disable the antilock out rule you should be able to get to the gui, you didn't turn that off did you? Please post the rules on your lan.. For example here is mine.

                                            antilock.jpg

                                            And you have no rules in floating tab?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.