CE and Plus wierdness
-
@Gertjan - Thanks for your reply, both machine's are running W10. Curious where that lonig pg id hosted?
@Johnpoz - Thanks, both machines are wired via Ubiquiti switch so no and SSID issue. Also confirmed (via direct conect to the console) that CE is loaded on the appliance.
Tried the password reset option which didchange it on PC2 but not PC1
I'll check the arp table and report back.@Gblenn - Come to think of it I vaguely recall renewing a cert over the holidays, didn't think anything of it. But:
-Why would a new cert change my login creds?
-Why would the new cert show a different version?
and more important...
-Any idea how to roll it back or fix it?Thanks everyone for the assist!
-
@rbwillis if you are hitting 2 different machines - then yeah the cert not going to match up with what your client has if it use to talk to pfsense 1 vs now this other one running plus.
It would seem impossible to me that pfsense could present like that if it is in fact the same device.. Could be something cached in a browser maybe.. But if was the same device and browser showing some cached pages from another pfsense you had talked to on the same IP.. The password would be the same if its actually the same pfsense instance.
But as a sanity check I would for sure look at the mac your seeing for what is your pfsense IP your hitting.
You are using IP to talk to pfsense gui - or are you putting in a fqdn? Possible those resolve to 2 different IPs on 2 different client machines.
Personally I find it highly improbable that your actually talking to the same pfsense instance from from your 2 different clients - it just seems impossible how pfsense could present 2 different pages one + and the other CE, and even if it did - the username and password would be the same no matter what web page it presented.
-Why would a new cert change my login creds?
-Why would the new cert show a different version?They wouldn't
The logical answer to what your seeing is your talking to two different instances of pfsense.
-
@rbwillis said in CE and Plus wierdness:
- Come to think of it I vaguely recall renewing a cert over the holidays, didn't think anything of it. But:
-Why would a new cert change my login creds?
It wouldn't but it may look like it's not accepting your login. I gues in such a case one would be looking at a cached page, that needs to be refreshed.
-Why would the new cert show a different version?
Definitely shouldn't, and that part is a mystery, unless it was some mistake on your part, like wrong IP? Sometimes you enter an IP, but when you click, the autoenter feature of the webbrowser has given you something else...
- Come to think of it I vaguely recall renewing a cert over the holidays, didn't think anything of it. But:
-
Yeah check the cert checksums on each page (assuming both are https) and make sure they really are different.
You could have something cached on one of the client machines. If it ever connected to a Plus device on the standard LAN address.
-
@stephenw10
So, here are the arp-a logs from both machines.
Different PC's hitting the same MAC with two different login screens.
-
@rbwillis your hitting port 8008 on one and just normal 443 on the other.. 8008 is the captive portal login I do believe. I know the captive portal is 800 something might be 2 or 3 depending if http or https, but I think if you fire up more than one that can change, etc.
But clearly that is not the normal web gui port on 8008. So yeah your normal admin login might not work on whatever your hitting there on that odd port.
-
Yup it adds two new ports for each instance I believe.
-
@stephenw10 yeah I just enabled a couple and 2 different ports got added, so like 8002,3 and then 8004,5
If you track down per pid on what is listening, you can track it to the command that is running, etc
And then here is my 2nd one running
So 8008 to me would be like the 3rd captive portal running. Or something like that, maybe 4th.. Not sure how exactly chooses those ports or how it cycles through them when you add more instances - or if you check to run a https one as well, etc.
but yeah seems like he is hitting a captive portal gui vs just the normal web gui.
-
@johnpoz - Is there a simple way to point my requests back to a "normal" web gui or do I need to mod something?
Where does that captive portal login reside? Can I just delete it? -
Do you actually have captive portal enabled at all? It's in Services > Captive Portal.
If you are not entering port 8008 directly then you're being redirected to it by the captive portal. On something.
-
@stephenw10
Captive portal is not set up.
I have HP Wolf security on my machine...could that be redirecting me?
I tried disabling all the services, but still landed on the same page. -
Hmm, well it sure looks like that one client is behind some other pfSense Plus device that is running CP.
Try running on the pfSense you can access:
sockstat -l4
See if it's actually listening on port 8008. -
@stephenw10 well from his mac address he posted its the same machine.
Like to see what is listening on the captive portal port.. When I disable my test captive portals it stops listening on the 8000 ports.. But maybe something didn't get killed and its still listening, and somehow that machine keeps going back to there because of cache, etc.
but something is odd because my test captive portals don't show the pfsense+ logo. they just show pfsense
This other machine maybe at one time connected to a captive portal, or just normal gui where they had changed the port to 8008 vs 443, or some other port.. For example my pfsense uses 8443 because I set that.
The one that is working without the + looks to just be on https (443) but guess it didn't trust the cert is why it shows not secure. And the one that shows + is connecting to port 8008, which yeah would assume is captive portal..
I would look to see what is listening with on 8008, you can track down the command that was used via ps -awx once you know the pid(s) there are prob a few being shown for what is listening on 8008.
-
Yeah the MAC address being the same is odd...
