How capture webGUI traffic?

Bognad

I can't capture webGUI trafic.
I have configured to use 8877 port for webGUI.
Try capture via webGUI:

via cli:

I have not packets

Grimeton

You sure you on the right interface and everything?

Because it's simple https traffic in a tcp connection. Decoding it is a different story but it usually just works.

Gertjan

@Grimeton said in How capture webGUI traffic?:

You sure you on the right interface and everything?

Just filled in LAN, where the traffic comes from, and as a port 443 - the https default.

Just one minute of pfSense GUI surfing yielded a huge capture ....

You have a problem with your interfaces or what ?

Edit :

edit again : oops : It was listing any connection to "443" as a destination, which includes also other traffic from devices that uses the internet.

NogBadTheBad

@Bognad

Lol why would you blank out the interface name.

Gertjan

See https://forum.netgate.com/topic/150395/gui-accessible-can-t-block-webgui-access-on-all-interfaces-unless-wan/4 - was asking the same thing.

Bognad

@Gertjan
Thanks, that topic is mine)

NogBadTheBad

@Bognad said in How capture webGUI traffic?:

@Gertjan
Thanks, that topic is mine)

He was replying to me "Lol why would you blank out the interface name."

Not sure how you expect people to help with everything blanked out!

Bognad

Thanks it isn't interface problem

Gertjan

@Bognad said in How capture webGUI traffic?:

Thanks it isn't interface problem

Possible.
We can't really know.

Something that works right away : re install pfSense.
Set up WAN so you have an Internet connection.
Do not change anything else.
Your two issue will be gone.

Now, to know what happens right now, ..... up to you to show details. Some on the forem users will see and recognize the issue and post accordingly.

Bognad

thanks, i will add information, if i will found something

johnpoz

Which port is it 8077 or 8877? In your other thread you say its 8077..

You SURE that is the port your gui is listening on ;)

Bognad

@johnpoz
I sure that port is listening on, i connected to webGUI via that port)
i have change port 8077 to 8877

johnpoz

Well then you would see the traffic via tcpdump then... You sure your using the correct interface em0?

Capture all traffic - are you seeing traffic at all on that interface... If your not seeing traffic to whatever port its on.. Then your coming in a different interface, you have the wrong interface selected, or the wrong port.

Why would you change ports? Because your block rule wasn't working and you think changing the port would magically start working? If you allow traffic, and state is created and then create a block rule - you have to flush the old state.