Disable webGUI on WAN without blocking port 443 for OpenVPN

fw · Mar 13, 2020, 4:35 AM

I'm using an OpenVPN server on WAN port 443 to get around a firewall on the client side, however, I didn't realize that OpenVPN was sharing the port with webGUI. I really don't want the webGUI to be accessible on the WAN interface. How do I disable the webGUI on WAN interface without blocking port 443 via firewall rule?

RHLinux · Mar 13, 2020, 7:09 AM

@fw

You will have to remap the GUI to a different port (such as 1443). Under System -> Advanced. Change the TCP port to 1443, check the webGui redirect checkbox (disable redirect).

This will move the GUI to port 1443. To connect to pfSense, https://xxxxxxxx:1443

RHLinux

JKnott · Mar 13, 2020, 1:59 PM

@fw

The GUI is normally not reachable from the WAN side. Did you test from there or the LAN side?

johnpoz · Mar 13, 2020, 1:55 PM

You can not run 2 services on the same port on the same IP anyway. So not sure how you think this would happen? if you want to run openvpn on 443, then you would need to change your gui https port.

fw · Mar 13, 2020, 1:55 PM

@johnpoz You can actually. See here:
https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/sharing-a-port-between-openvpn-and-a-web-server.html

Now that I think about it though, port sharing is not turned on by default, and the way that I figured out that webGUI was enabled on WAN was I had openVPN working on port 443, and then server temporarily (which was running and working correctly on port 443), at which point I noticed that port 443 was still open, even though I disabled the VPN service, and when I connected with a web browser on https, I got the webGUI.

So I guess that means that as long as openVPN is up and running on port 443, it will probably block access to webGUI on WAN (I think). That seems very insecure way to do it though. It would be annoying to have to move webGUI to a non-standard port just because I don't have any other way to block it on WAN without blocking VPN. I don't understand why webGUI is enabled on all interfaces/IPs and there is no way to prevent that?

fw · Mar 13, 2020, 1:59 PM

@JKnott I tested from the WAN side. I tethered my laptop through my phone with wifi disabled and was able to confirm that the webGUI came on https on WAN.

JKnott · Mar 13, 2020, 2:13 PM

@fw

Then you must have specifically enabled access via the WAN. I just tried from the WAN side and wasn't able to connect. I also did a port scan with www.grc.com and both port 80 & 443 are stealth.

Here's some info on enabling WAN access.

fw · Mar 13, 2020, 2:21 PM

@JKnott The only thing I did was add a firewall rule on WAN to allow TCP packets on port 443. This firewall rule is needed for VPN, but also allows access to webGUI.

JKnott · Mar 13, 2020, 2:31 PM

@fw

Did it allow access without that rule?

fw · Mar 13, 2020, 2:31 PM

@JKnott No.

JKnott · Mar 13, 2020, 2:35 PM

@fw

Perhaps you can use port 80 for the GUI. I know that means plain HTTP, but at least it won't be exposed to the Internet. Another possibility is if the client has a fixed address, then add that address to the rule.

fw · Mar 13, 2020, 2:37 PM

I just realized that I could probably set webGUI to listen on port 1443, and then do port forwarding from port 443 to 127.0.0.1:1443 on specific interfaces only. It looks like port forwarding is configurable per interface. I think that would do exactly what I want.

JKnott · Mar 13, 2020, 2:52 PM

This post is deleted!

johnpoz · Mar 13, 2020, 3:32 PM

Yeah lets go over this yet again... it is not possible to listen on the same port on the same IP at the same time... How exactly would that work??

Sure you can port share, I do that myself actually but sure and the F not for the gui, but for a haproxy that sends traffic to the backend for other stuff. And a port share is still not services listening on the same port on the same IP at the same time.

I would highly suggest if you want to use 443 for anything, be it openvpn, haproxy, port forward that you change your webui to use something else 8443 is typical for https to run on when you don't want to run on 443.

If you try and run 2 different services on the same IP on the same port - you create a race condition, there can be only one.. And depending on who wins the race you would have that one, or quite possible you could end up with nothing.. You do not want race conditions.

Configure your webgui port to be listen on something else!

One reason I could think of not setting what interface webgui would listen on vs all of them - is promise you users would F it up!!! And we would be bombed with can not get to my web gui threads ;) hehehe

JKnott · Mar 13, 2020, 4:32 PM

@johnpoz

I think the idea is he doesn't want to access the GUI via the WAN port, but creating the rule to allow the VPN on port 443 opens access to the GUI too. Other than moving the GUI to a different port number, as he mentioned, I don't see any way to block access to it.

johnpoz · Mar 13, 2020, 4:40 PM

If you have a service listen on port X on your wan IP... And then you allow access to that port - then yeah no freaking shit you be able to access it - DUH!!!

But here is the thing - you can not run 2 services on 443 on 1 IP... So there is never a scenario where this would be an issue! Ever!!

Change your freaking port of gui if your going to run something else on 443 - its that freaking simple!

If I set up a race condition by setting 2 services to use the same port, and then I get lucky and the one I am trying to use works at the time... And then I turn off that service and the other service works - yeah no shit you can access it if the port is open.

The root of the problem is you think its ok to try and run more than one service on the same IP on the same port - which is borked!!! It not going to work how you think its going to work.. You can not do it!!

JKnott · Mar 13, 2020, 4:44 PM

@fw said in Disable webGUI on WAN without blocking port 443 for OpenVPN:

I just realized that I could probably set webGUI to listen on port 1443, and then do port forwarding from port 443 to 127.0.0.1:1443 on specific interfaces only.

Or perhaps forward 443 from the WAN interface to 1195.

fw · Mar 13, 2020, 4:50 PM

@johnpoz Why should I have to change the webGUI port on my LAN interface just bc there is some other service running on that port on an unrelated interface (WAN)? That's pretty stupid that pfsense webGUI works like that.

JKnott · Mar 13, 2020, 4:54 PM

@fw

The problem is that all traffic that enters the box passes through 0.0.0.0 and then gets sorted according to address. As far as I know, there is no way to limit what interface something comes from, other than the firewall rules, which aren't up to this task. As I mentioned, you can try forwarding WAN port 443 to 1195, instead of changing the port the GUI uses. Perhaps the solution is for pfSense to support the concept of a management interface, which has nothing to do with passing traffic.

fw · Mar 13, 2020, 4:53 PM

@johnpoz said in Disable webGUI on WAN without blocking port 443 for OpenVPN:

If you try and run 2 different services on the same IP on the same port - you create a race condition, there can be only one.. And depending on who wins the race you would have that one, or quite possible you could end up with nothing.. You do not want race conditions.

I'm not trying to run 2 different services on the same IP on the same port. I'm trying to run 2 different services on different IPs on the same port (i.e. one on LAN IP and one on WAN IP). I don't understand why pfsense doesn't allow that.