Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New install - with access to WAN Web GUI only

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    8 Posts 3 Posters 828 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Tim Harris
      last edited by

      When I do an new install (as a VM) with a WAN and LAN interface I can set up and do all the configuration via the Web interface over WAN. This includes setting up to respond to ping. If I then reboot the instance I can no longer access the web GUI over the wan interface. I'm clearly missing something?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Your going to have to give some more context... Where is this VM your setting up, where are you? What rules are you putting on the wan? How exactly are you setting it up?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        T 1 Reply Last reply Reply Quote 0
        • T
          Tim Harris @johnpoz
          last edited by

          @johnpoz Sure... so Host is KVM server and pfsence sits as a VM on that server. Server has external public IP and internal (LAN/DMZ) networks (using bridge). When I do a clean install and only have a WAN interface connected to the public network I can assign a IP and connected to the web configurator interface in just fine using the public address. Apart from the adding a rule to allow the FW to reply to Ping on the WAN IP, I have not added any more FW rules beyond what is has out of the box. If I reboot the FW , I can still connected via the WAN IP to the web GUI. I add a LAN config (e.g. assign interface and add static IP range) then I can still access the FW GUI over the WAN IP. If I then reboot the FW, I loose access to the Web GUI over the WAN - trying to connect and it just hangs. Ping is still OK.

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @Tim Harris
            last edited by

            @tim-harris said in New install - with access to WAN Web GUI only:

            I loose access to the Web GUI over the WAN

            But at that moment you have full LAN access.... interface names shifted after creating the second interface, LAN ?
            But I agree that a WAN interface that has been set up to gain access to the GUI should persists after a reboot.

            Btw a complete setup starts by setting up a LAN, and then WAN.

            I don't quiet understand why your setup should be done 'backwards' : can't explain, but it seems strange to me.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              You do understand that when you have WAN only the antilock rule will be there to allow you access to the gui right. Creating the LAN interface and it will still have access via state. But when you reboot the antilock rule will be gone an there will be no states. Since the antilock out rule will be on your LAN now.

              This is WAD (works as designed) for sure.

              If you create an actual rule on the wan to allow gui access then that will persist.. Why you start with such a setup is beyond me.. You should be setting up wan and lan when your first setup pfsense, etc.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              T 1 Reply Last reply Reply Quote 1
              • T
                Tim Harris @johnpoz
                last edited by

                @johnpoz Ok... that's cool... I just tested this and I can see this antilock rule moves to the LAN once I set it up. ls there a way to move the webConfigurator rule to another interface (back to the WAN). There is no browser base service on the LAN so hence the need to access via WAN interface. Thanks for the speedy and accurate responses .. amazing

                T 1 Reply Last reply Reply Quote 0
                • T
                  Tim Harris @Tim Harris
                  last edited by

                  I think this section covers what I just asked:

                  https://www.netgate.com/docs/pfsense/firewall/remote-firewall-administration.html

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    I personally wouldn't open gui on the wan, unless you have a way to lock it down to your source IP... You prob be better VPN to pfsense, then hit the gui.. Problem with that is if problem with vpn you can not access gui to fix it ;)

                    If you know the source IP(s) that you will admin from, then you can allow access to gui port via a rule on your wan limiting it to these source IP(s).

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 1
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.