Bind webGUI only to certain interfaces

[johnpoz]

You don't need a nat rule, just a rule to allow it on the wan to the wan address and the port the gui is on.

[dam034]

Thanks for the replies.

Now I want to ask the same informations about the SSH connection.

Should have I to open another topic or can I continue here?

Thanks

[johnpoz]

What is your question? That port will be allowed on lan as well for antilockout.

[dam034]

Just a moment.

I create a teporarily rule to enable the webGUI on WAN interface:

But visiting from my smartphone in data connection, I can't access it.

Am I wrong?

Thanks

[johnpoz]

Does pfsense have a public IP on its wan, or its it behind a NAT? Its quite possible your ISP blocks port 80 inbound.. Many do on home connections, etc.

I don't see any hits on that rule - so traffic prob never even go to pfsense. that 0/0 tells me nothing has hit that rule

[dam034]

The pfsense machine WAN IP is private, and I'm now trying from another pc in the same LAN as pfsense's WAN interface.

Is there any mistake?

Thanks

[Gertjan]

@dam034 said in Bind webGUI only to certain interfaces:

The pfsense machine WAN IP is private, and I'm now trying from another pc in the same LAN as pfsense's WAN interface.
Is there any mistake?

No mistake at all.
Look at your firewall rules.
The first rule is put in place 'automatically' when you check this option on the WAN interface.
Here it is :

So, when this box is checked - yours is checked - local IP's like (192.168./16 10/8 etc) are blocked.
The counter in front of your first rule indicates it is blocking "something".
These must be your attempts to use your phone to connect to the GUI.

When you use your phone, you use some real WAN IP (an address IPv4 that is addressable on the Internet).
The connection comes in on your first router, probably the one your ISP gave to you, or some other upstream device.
This device NAT's to the pfSense WAN IP - and this IP is a "RFC 1918" class IP.
pfSense, according to your instructions, blocks these IP's.

Btw : before you ask : the second rule will not bother you, although it's a nice exercise to know who's triggering that rule ^^