Disable webGUI on WAN without blocking port 443 for OpenVPN
-
@fw said in Disable webGUI on WAN without blocking port 443 for OpenVPN:
I don't understand why pfsense doesn't allow that.
Because there is not currently a way to just bind the webgui to the lan IP... It has been asked about for YEARS! Here is a thread from last year
https://forum.netgate.com/post/826148So since you can not do that - change the port! Its that that simple if you want to run something else on 443.
-
I got the port forwarding working, but the setup was a little different than I expected. I set the webGUI port to 1443. I thought that if I wanted to access the webGUI on port 443 on the LAN IP while connected on my VPN, I would setup a NAT to forward port 443 to 1443 on the LAN interface. However, that doesn't work. What I had to do instead, was forward 443 to 1443 on the openVPN interface instead of the LAN interface, even though I'm actually accessing the LAN IP, not the VPN IP. I guess that sort of makes sense. Just confused me a little. I guess I'll have to add separate port forwards for each interface that I want to use to access the webGUI from.
-
@fw said in Disable webGUI on WAN without blocking port 443 for OpenVPN:
I guess I'll have to add separate port forwards for each interface that I want to use to access the webGUI from.
Why not forward the VPN, on 443, to 1195 instead? That would definitely go on the WAN interface and you wouldn't have to worry about anything on the WAN side.
-
@JKnott said in Disable webGUI on WAN without blocking port 443 for OpenVPN:
Why not forward the VPN, on 443, to 1195 instead? That would definitely go on the WAN interface and you wouldn't have to worry about anything on the WAN side.
That's true. I might try that. One advantage to doing it the other way though is that I'm less likely to mess it up in the future. It's highly unlikely that I would accidentally allow 1443 on WAN firewall rules, whereas I could see myself messing with the port forwarding and accidentally disabling that particular port forward. Disabling the port forward if it was on WAN would expose webGUI to WAN, whereas disabling a port forward on LAN would be safe.
-
What I do is have 8443 as my webgui, I do have vpn on 443 because I use it every day from work (have to go through a proxy at work that only allows 443).. I then have share port setup, and forward specific fqdn to port on haproxy that gets sent to backend.
Works perfectly.. No issues accessing vpn, nor website...
port-share 127.0.0.1 9443Then HA proxy listens on that port, and sends to backend.. Its even doing the ssl offload because the backend system doesn't really support ssl (requests for my plex users running ombi)
-
Its because you added a firewall rule on the WAN interface to listen on 443 and go to destination firewall(self). This is typical because openVPN runs as a service on the firewall as does the GUI... hence the firewall(self) part is a common point.
Since firewall(self) also runs the GUI on port 443 you will have the issue you describe.
I suggest that you do port forwarding.... leave OpenVPN on 1194 and forward from the WAN to firewall(self) port 1194. This would be the easiest and you can still keep the GUI on 443. This would also allow you to run OpenVPN on other ports also... for example you can port forward from the WAN 443 and 1194 or any other port to OpenVPN on 1194.
RHLinux
-
@RHLinux said in Disable webGUI on WAN without blocking port 443 for OpenVPN:
leave OpenVPN on 1194 and forward from the WAN to firewall(self) port 1194.
You would have to make sure that openvpn is using tcp on this port..
Just change the gui port, it takes all of a couple of seconds to do, its a 1 time thing.
-
Well I assumed he was using TCP due to the fact that he was using 443 and getting the web GUI. It is just a switch of the OpenVPN from UDP to TCP which he has already done...
RHLinux
-
Default port is 1194 and UDP.. While I agree he is using tcp, when you call out forwarding to 1194 - best to make sure you mention that in this scenario it will need to be TCP and not the default UDP port is all I was wanting to point out ;)
