Can I make VLAN interfaces not to listen to SSH and HTTPS

ChrisT

Hi all, maybe my question is stupid, but I'll make it because I feel stuck. I have a pfsense with several internal VLANs. Each of these VLANs has of course a VLAN interface. One of these VLANs is the IT VLAN, which has access to everywhere (in the fw rules I have an allow IT VLAN to any for this VLAN).

From my computer which belongs to IT VLAN, if I try to access the IP address of all of the VLAN interfaces, I see that I can access all of them. But I only want to be able to access my fw from a specific VLAN interface (VLAN 100 - with IP address 10.55.100.1). Do I do this by setting deny rules for these VLAN interfaces, or is there any option to make VLAN interfaces stop listening to HTTPS and SSH?

Thank in advance!

kiokoman

Disable webConfigurator anti-lockout rule
set deny rules for VLAN interfaces to the firewall ip with destination port https / ssh
be careful not to shut yourself out completely

jimp

While you can't yet change which interfaces the GUI and SSH listens on, you could setup some floating rules to make this easier, something like

Pass quick TCP from <your management subnets> to This firewall (self) ports <alias with 443, 22, etc>
Reject quick TCP from any to This firewall (self) ports <alias with 443, 22, etc>

The "This firewall (self)" target expands internally in pf to any address on the firewall.