Open Ports
-
Update: Put cable modem/router back into gateway mode and still getting port 80 and 443 open on grc.com when openvpn client is running. All ports are fine without openvpn.
How do I disable remote management access?
-
I would leave it in Bridge mode myself…
I seriously doubt anyone can see your pfsense gui from the outside if you haven't allowed it.
Your modems gui might be another story. Who is your ISP?
Ask someone you know to try and access your IP address with a browser and see what they get.
Good Luck!
-
Just checked myself with my cell phone on the cell network (not wifi) and up popped the pfsense login screen!
Im on Rogers in Canada.Need to get this fixed before I can use this. How do I disable remote access?
-
Can you post a screenshot of your WAN firewall rules?
Is your phone connected to the same VPN?
-
Cell phone was not on the vpn or the wifi. Checked using lte network
Lets hope this works…......attaching....... :)
 -
Yep that worked.
And as I thought. You have the entire world allowed to see everything.
You need to turn that rule off.
What are you attempting to give the world WAN access to?
-
I think I saw that rule in another guide and added it to see if it helped.
Deleted it and rebooted but still seeing port 80 and 443 open -
VPN rule?
Im wiress for a bit. But this sound like you have a vpn firewall rule thats set to any. -
The wan rule you said should be deleted. I want to route all traffic through the VPN to my VPN provider.
-
Yep understood. VPN rules are also incoming. Shut any off.
-
Great success! (in my best Borat voice)
Looks like that fixed it. I'll give it a reboot to make sure and post back.
Thank you!
-
Looks like its sticking.
Thanks again for your help chpalmer. Now I can enjoy my weekend!
-
Congrats!
Keep in mind that rules on an interface are incoming to that interface. By making an "any" to "any" rule on WAN or VPN you let anything through to anything. ( this took me a few times to get across to myself…)
For a box only dealing with clients on the lan side and no servers (no reason to allow someone on the outside acess to the inside) there should never be any rules for other than the LAN interface.
