Bind webGUI only to certain interfaces

[Derelict]

The anti-lock rule is on LAN, not WAN.

If you absolutely MUST access the webgui from over the WAN, I would strongly suggest source limiting the firewall rule to a subset of administrative networks/hosts (You can use a firewall Alias for this). Then you just pass TCP to WAN address on the webgui port you set in System > Advanced.

Nothing magical here.

[johnpoz]

The antilockout rule is ONLY On the lan interface, or on wan when there is ONLY the wan interface.

You can disable it here
System / Advanced / Admin Access

There is checkbox to disable antilock out

[dam034]

So now the webGUI isn't accessible from WAN, but if I create a NAT rule, it can be.

The NAT rule can accept connection from a subnet like 79.12.24.0/24 so only 254 IPs can access webGUI from WAN.

Am I right?

Thanks

[johnpoz]

You don't need a nat rule, just a rule to allow it on the wan to the wan address and the port the gui is on.

[dam034]

Thanks for the replies.

Now I want to ask the same informations about the SSH connection.

Should have I to open another topic or can I continue here?

Thanks

[johnpoz]

What is your question? That port will be allowed on lan as well for antilockout.

[dam034]

Just a moment.

I create a teporarily rule to enable the webGUI on WAN interface:

But visiting from my smartphone in data connection, I can't access it.

Am I wrong?

Thanks

[johnpoz]

Does pfsense have a public IP on its wan, or its it behind a NAT? Its quite possible your ISP blocks port 80 inbound.. Many do on home connections, etc.

I don't see any hits on that rule - so traffic prob never even go to pfsense. that 0/0 tells me nothing has hit that rule

[dam034]

The pfsense machine WAN IP is private, and I'm now trying from another pc in the same LAN as pfsense's WAN interface.

Is there any mistake?

Thanks

[Gertjan]

@dam034 said in Bind webGUI only to certain interfaces:

The pfsense machine WAN IP is private, and I'm now trying from another pc in the same LAN as pfsense's WAN interface.
Is there any mistake?

No mistake at all.
Look at your firewall rules.
The first rule is put in place 'automatically' when you check this option on the WAN interface.
Here it is :

So, when this box is checked - yours is checked - local IP's like (192.168./16 10/8 etc) are blocked.
The counter in front of your first rule indicates it is blocking "something".
These must be your attempts to use your phone to connect to the GUI.

When you use your phone, you use some real WAN IP (an address IPv4 that is addressable on the Internet).
The connection comes in on your first router, probably the one your ISP gave to you, or some other upstream device.
This device NAT's to the pfSense WAN IP - and this IP is a "RFC 1918" class IP.
pfSense, according to your instructions, blocks these IP's.

Btw : before you ask : the second rule will not bother you, although it's a nice exercise to know who's triggering that rule ^^