Solved: Locked out remote pfsense box, except for ssh. How to restart firewall?

bertw · Sep 13, 2008, 1:40 PM

Hi all,

Was managing a remote (many 100's of km's away) pfsense box over an IPsec tunnel. Foolishly I removed outside access from the Ipsec-tab on the firewall ruleset page. Luckily I still can access the remote box using ssh. That rule survived.

Now I've got the question. How to add access to the firewall rule set using commandline and activate it subsequently. The ruleset I would like to ad to /conf/config.xml would be:

<rule><type>pass</type>
<interface>enc0</interface>
<max-src-nodes><max-src-states><statetimeout><statetype>keep state</statetype>

<address>remote LAN/24</address>

<destination><address>IP of the remote box</address></destination>
<descr>some description</descr></statetimeout></max-src-states></max-src-nodes></rule>

Will it help to add these lines?
From there I don't know what to do. Please advise.

Regards,
Bert

bertw · Sep 12, 2008, 7:44 PM

It seems like the web interface uses /usr/local/www/firewall_rules.php to restart. Is it in any way possible to start this script using php cli? When I start it I get a 'You must enter valid credentials to access this resource.' message.

About the box. It is a 1.2-RELEASE.

bertw · Sep 13, 2008, 1:39 PM

Solved it myself.

Edited config.xml using vi and added the lines mentioned above. Then restarted firewall using /etc/rc.reload_all.
After some 10 seconds web interface could be remotely accessed over the IPsec tunnel.

Straight on.

Regards,
Bert