Administer pfSense via Internet

lars.noack · Mar 6, 2009, 2:38 PM

Hi.

It is possible to administer pfSense via the internet (with gui)?
With my search in these forum I doesn't find a answer.
In the moment i can administer pfSense via local network only.

Thanks

Lars

Guest · Mar 6, 2009, 3:23 PM

This has been asked and answered so many times. Yes, open up a firewall rule on the WAN interface to allow you access to the webGUI.

jimp · Mar 6, 2009, 3:38 PM

If you open it up for outside access in any way, I'd suggest doing one or more of the following:

1. Use a VPN to get in first, IPSec, PPTP, or OpenVPN, but some sort of extra encryption/authentication would be a good idea
2. Use HTTPS
3. If you must open your WebGUI port to the Internet, try to restrict it by IP range as much as possible. Ideally, if you have a static IP at your location you want to manage from, only allow traffic from that IP or subnet.

GruensFroeschli · Mar 6, 2009, 4:31 PM

4: Set the webGUI to a nonstandard port (43876), wont help against a real attack but all the portscanning script kiddies cannot find an open http/https port.

jimp · Mar 6, 2009, 5:07 PM

(As GruensFroeschli probably knew I was going to say next…)

For future reference, I updated the Doc Wiki with these suggestions and some other notes.

http://doc.pfsense.org/index.php/Remote_firewall_Administration

There is an example firewall rule screenshot there as well, but I will probably edit/replace it with something that lines up a little better.

lars.noack · Mar 6, 2009, 6:47 PM

Hi.

Thanks for your many answers.
I think my searchwords are wrong…... ???
Ok, thanks for the fantastic posts.

...OpenVPN is my next challenge.
I read some docs but it doesn't works until today.
On my next holiday I work on it.. ;)

Lars