Bind webGUI only to certain interfaces

dam034 · Feb 23, 2019, 3:36 PM

Dear users,

for security reasons, I want to bind for listening the webConfigurator only to LAN interface, and not also to WAN interface, and leave it to port 80.

Moreover, I want to know if it's possible to forward the port 80 from WAN interface to one internal IP, also if the port 80 is listening for webGUI, but only for LAN interface.

Thanks

Gertjan · Feb 23, 2019, 4:26 PM

@dam034 said in Bind webGUI only to certain interfaces:

for security reasons, I want to bind for listening the webConfigurator only to LAN interface, and not also to WAN interface, and leave it to port 80.

Even if the GUI is listening to all interfaces, including WAN, there is no firewall on WAN to let something coming in.
So : no risk.
It's possible to NAT incoming "port 80" connections to some internal we server.
Put this web server on some OPTx interface - hand have port 80 (incoming connections for pfSense ) blocked and you'll be good.
On the LAN interface (or any other interfcae) you can lock down the GUI access to one known IP.
GUI access from the outside is also easy : that where the VPN server helps you.

dam034 · Feb 24, 2019, 1:14 PM

So my pfsense machine has only two ethernet ports, LAN and WAN.
I don't need a VPN server, so I want to disable GUI access from WAN.
And leave the GUI access on port 80.

Then, I only need to forward the port 80 to the web server, so when I visit http://wan-ip/ I see the website.

How can I do?

Thanks

Gertjan · Feb 24, 2019, 4:55 PM

By adding a NAT rule for port 80 to your web server on LAN.

dam034 · Feb 24, 2019, 5:16 PM

And what I have to do to disable webGUI on WAN interface?

Thanks

Gertjan · Feb 25, 2019, 12:30 AM

Nothing.
pfSense acts as any other router/firewall on the market : add a NAT rule to some LAN based device and you're done.
Why should it behave any different ?

Derelict · Feb 25, 2019, 3:12 AM

And what I have to do to disable webGUI on WAN interface?

You don't. It listens on all interfaces. If you don't want people on a certain interface to connect to the web gui, don't pass the traffic.

If you want to forward 80 and 443 around to other places, it is generally better to change the webgui port in System > Advanced.

I would suggest setting it to https and setting the port to something like 8443.

dam034 · Feb 25, 2019, 3:42 PM

Can I leave webGUI on port 80 and forward port 80 to the web server?

So visiting http://wan-ip/ I will see the web server or webGUI?

Thanks

Derelict · Feb 25, 2019, 4:07 PM

I wouldn't. I'd change the port.

johnpoz · Feb 25, 2019, 4:11 PM

If you want to use 80 elsewhere, its better to change the gui port not use 80 and also disable the 80 redirection to https for the gui.

Gertjan · Feb 26, 2019, 6:51 AM

@dam034 said in Bind webGUI only to certain interfaces:

So visiting http://wan-ip/ I will see the web server or webGUI?

It will take you 30 seconds to answer that question ;)

Btw : ok, I agree, easy initial GUI access on port 80 from LAN exists so you can take ownership of your pfSense installation.
You're ought to install a cert - one that will be accepted by your browser **, install it into the GUi, and switch the GUI to https. This https access isn't necessary port "443".
It's like running a remote Linux/FreeBSD remote server : initially, you'll be handed over a user/password (like root/######). You ditch the root access, blow away user/password access, install private/public keys on server and your ssh client, and then your admin access is somewhat more safe.

** obtain one from a certificate authority - or generate your own, and import necessary files into your browser so it won't complain.

dam034 · Feb 26, 2019, 2:33 PM

If I understood good, I can't disable webGUI on WAN interface, but I can:

change the webGUI to another port (e.g. 28428)
forward the port 80 and 443 to web server
disable webGUI redirect to https
set strong username and password

Am I right?

Thanks

johnpoz · Feb 26, 2019, 2:43 PM

Out of the box the web gui is NOT available from the WAN, no matter what port it listens on. Unless wan is the only interface pfsense has.

You can yes access the wan IP from lan side depending on how the rules are set.. If you do not want an IP to access the web gui via the wan IP from the local networks, then block it with a firewall rule.. Turn off the antilock rule if on the lan and only allow access to web gui port from your IP..

Gertjan · Feb 26, 2019, 3:33 PM

@dam034 said in Bind webGUI only to certain interfaces:

change the webGUI to another port (e.g. 28428)
.....
disable webGUI redirect to https

You can't disable WebGUI.

You should do this :

==> check the HTTPS button.
Done.
And before you switch to https, using the default "443" port or whatever (or close to what ever - see TCP port) port at your choice, you should prepare a certificate. See System => Certificate Manager.
If your imported the certicate from an certificate authority, you'll be fine right away. If the certificate is signed by your pfSense itself, export it and import into your browser (these days modern browser do not like self-signed cert anymore - importing them in the browser's trusted-list makes them stop yelling to you).

Btw : If you use a cert, think about setting these

in consequence.

dam034 · Feb 26, 2019, 4:25 PM

Thanks for your replies.

Connecting with the data connection of my smartphone, I realized the webGUI isn't available on WAN interface, but is available from LAN interface visiting WAN IP.

About SSL, in LAN I don't need the HTTPS, but I can change the port of webGUI so the LAN users have less possibility to reach the webGUI. But I already know it's useless.

Now the question is reversed: if I will need the webGUI from the internet, can I enable it?

Thanks

johnpoz · Feb 26, 2019, 4:31 PM

@dam034 said in Bind webGUI only to certain interfaces:

if I will need the webGUI from the internet, can I enable it?

Yes you can - but its a REALLY BAD IDEA!!! If you need to admin pfsense from internet side it would be better to vpn in, then admin it through the vpn connection.

The gui will be available via the lan network with the antilock rules in place, no matter what port you change the gui too. You would need to turn off the antilock out rule, and then only allow the IPs you want to access the gui be it on the actual lan IP or another IP or even the wan IP from the lan side.

As to blocking users, its pretty trivial rule to block IPs you don't want to access the gui. But on the lan you have to disable the antilock out, then just create rule that blocks access to the gui port on firewall (built in alias) This will block ALL ips firewall, lan, wan, opt, etc..

dam034 · Feb 26, 2019, 4:38 PM

Yes, I know it's a bad idea, and now I'm not thinking to do it.

I just want to know how to do it.
I have understood that there is an antilock rule which commands the webGUI.
Can you show me in what page I can manage it?

Thanks

Derelict · Feb 26, 2019, 4:44 PM

The anti-lock rule is on LAN, not WAN.

If you absolutely MUST access the webgui from over the WAN, I would strongly suggest source limiting the firewall rule to a subset of administrative networks/hosts (You can use a firewall Alias for this). Then you just pass TCP to WAN address on the webgui port you set in System > Advanced.

Nothing magical here.

johnpoz · Feb 26, 2019, 4:46 PM

The antilockout rule is ONLY On the lan interface, or on wan when there is ONLY the wan interface.

You can disable it here
System / Advanced / Admin Access

There is checkbox to disable antilock out

dam034 · Feb 26, 2019, 4:47 PM

So now the webGUI isn't accessible from WAN, but if I create a NAT rule, it can be.

The NAT rule can accept connection from a subnet like 79.12.24.0/24 so only 254 IPs can access webGUI from WAN.

Am I right?

Thanks