Design Flaw: Web GUI listens on WAN with no disable
-
Design Flaw:
The Web GUI also listens on WAN. Not including a settings option to disable this is a design flaw. If a firewall rule, such as a temporary whitelist, inadvertently allows access to the router then the Web GUI becomes accessible. When I discovered this, there was much swearing. But, OPNsense has the same flaw so I’m still here.
The commonly advised countermeasure is to change the port from 80 or 443, but that naively assumes that attackers won’t be scanning and analyzing all ports. I’ve had about 1.8 million attacks over the last 3 weeks. Attackers have probed almost every port. -
Don't firewall rules work?
-
@muvaminon said in Design Flaw: Web GUI listens on WAN with no disable:
The Web GUI also listens on WAN.
And not only nginx, the GUI web server. If you run it, SSH, also listens on 'all interfaces'. Unbound, the resolver, same situation.
And things get worse : I'm not sure how many copies of pfSense are being used out there, but it must be 6 if not 7 digit number : they have all this issue.@muvaminon said in Design Flaw: Web GUI listens on WAN with no disable:
The commonly advised countermeasure is to change the port from 80 or 443, but that naively assumes that attackers won’t be scanning and analyzing all ports
So don't ^^ Security by obscurity doesn't stand long ... in 30 seconds using a GUI - and nmap will be way faster :
No ports open ! (this is the default Netgate pfSense behavior).
So no risk what so ever. Case closed.@muvaminon said in Design Flaw: Web GUI listens on WAN with no disable:
But, OPNsense has the same flaw so I’m still here
Yep, we start to see the trend also
The real issue is actually : the human part behind pfSense, also called the 'admin'.
Same as this :
The car has a steering wheel.... and you can turn it to the right. You've learned not to do so.
Should the wheel be removed ?
Ok, sorry, I'll be a bit more serious : I get it, why not double the security by not having the web server listing to the WAN NIC ?
It's easy to set up a web server (nginx) config file so it listen to one (pre selected, normally LAN) interface.
This is still possible, if you really want to do that.edit : @JKnott said it all using way less words.
