Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Preventing to access pfSense login page on IoT VLAN

    Scheduled Pinned Locked Moved Firewalling
    44 Posts 6 Posters 5.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      keesdek
      last edited by

      Hi,
      I did set up an IoT VLAN (192.168.73.0) with no access to the user LAN. I would like to block access to the pfSense login page on the IoT VLAN(192.168.73.1).

      How can I make this happen?

      Thank you in advance!

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @keesdek
        last edited by

        @keesdek
        Basically pfSense blocks any traffic which is not explicitly allowed by a pass rule anyway.

        If you want to allow internet access on the IoT VLAN, but not access to other internal network segments, add a pass rule to the IoT interface for any destination but your internal networks.
        Best way to do is adding an alias of type network and add all RFC1918 networks to it. Then use this alias for destination in the pass rule in conjunction with "invert".

        Consider also that floating rules with "Quick" option checked are applied before rules on the other interface tabs.

        K 1 Reply Last reply Reply Quote 0
        • K
          keesdek @viragomann
          last edited by

          @viragomann
          Thank you for your response!
          I am not sure if your answer applies to my question, but I am relatively new to networking😬
          In the current setup it is possible to login to the pfSense page on the IoT VLAN at 192.168.73.1. Normally I login on the pfSense page at my LAN 192.168.10.1.
          Is there a way I can prevent IoT users to even see my pfSense login page at 192.168.73.1 in the IoT subnet?

          V johnpozJ 2 Replies Last reply Reply Quote 0
          • V
            viragomann @keesdek
            last edited by

            @keesdek
            As I said, if there is no rule allowing the access explicitly pfSense will block it. So check you rules.
            By default there is an "anti-lock-out" rule enabled on LAN, but not on other interfaces. Maybe thismatches here if your VLAN is not configured properly.

            If you can't find the responsible rule, enable logging in all your rules and check the log.

            You also can add a block rule on the IoT for all RFC destinations, however a quick floating pass rule may override this as well.

            Also you may need to allow access to specific internal services like DNS, so will will need to add additional pass rules for this.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @keesdek
              last edited by johnpoz

              @keesdek said in Preventing to access pfSense login page on IoT VLAN:

              Is there a way I can prevent IoT users to even see my pfSense login page at 192.168.73.1 in the IoT subnet?

              Yes block it.. use of "this firewall" is prob best choice..

              Here is example rules for a locked down vlan - it would have no access to pfsense web gui.

              example1.png

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              KOMK K A 3 Replies Last reply Reply Quote 1
              • KOMK
                KOM @johnpoz
                last edited by

                @johnpoz OK John, it's bugging the hell out of me that in your first rule you call it pfsense, the 2nd it's Pfs, the 3rd it's pfs and the 4th it's Pfsense....

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @KOM
                  last edited by johnpoz

                  I think it had to do with doing it later, ie should prob be consistent ;

                  edit: ok is that better ;)

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  KOMK 1 Reply Last reply Reply Quote 1
                  • KOMK
                    KOM @johnpoz
                    last edited by

                    @johnpoz Much better

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @KOM
                      last edited by

                      Touch of the OCD, yeah I get that sometimes as well ;) heheh

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • K
                        keesdek @johnpoz
                        last edited by

                        @johnpoz Hi John, thank you for your input
                        I inserted a test VLAN (192.168.30.0/24) and put in the firewall rules you suggested. However I can still access the pfsense web gui at 192.168.30.1
                        Any other ideas?
                        TIA, Kees

                        KOMK 1 Reply Last reply Reply Quote 0
                        • KOMK
                          KOM @keesdek
                          last edited by

                          @keesdek Reset your states via Diagnostics - States.

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @KOM
                            last edited by johnpoz

                            ^ exactly. States are evaluated before rules. If you access something that is allowed, a state is created. Until that state expires or is deleted, that state will continue to allow traffic. Even if you create a rule that now should block said traffic.

                            Other things that could cause you problems - you have a floating rule that is allowing the traffic. Floating are evaluated before interface rules.

                            Your rules are not in correct order, rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            K 1 Reply Last reply Reply Quote 0
                            • K
                              keesdek @johnpoz
                              last edited by

                              @johnpoz Resetting States did the trick. But now I cannot connect to the internet from the Test VLAN. I tried changing the order of the rule -> still no internet...

                              KOMK johnpozJ 2 Replies Last reply Reply Quote 0
                              • KOMK
                                KOM @keesdek
                                last edited by

                                @keesdek Be more specific. Can you ping pfSense itself (assuming you allow pings in your rules)? Can you ping 8.8.8.8? If so, can you resolve a domain name?

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @keesdek
                                  last edited by

                                  If you want help with your rules - your going to have to post them.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    keesdek
                                    last edited by

                                    @kom Unable to ping anything. Computer is not able to acquire a DHCP address, while the DHCP server is active on the test VLAN

                                    KOMK 1 Reply Last reply Reply Quote 0
                                    • KOMK
                                      KOM @keesdek
                                      last edited by

                                      @keesdek Post a screen of your rules for that interface.

                                      K 1 Reply Last reply Reply Quote 0
                                      • K
                                        keesdek @KOM
                                        last edited by

                                        @kom 202105 Screenshot pfSense Test-VLAN Rules.png

                                        KOMK 1 Reply Last reply Reply Quote 0
                                        • KOMK
                                          KOM @keesdek
                                          last edited by KOM

                                          @keesdek Rules are processed top-down first match (except floating rules which are last-match unless you have the Quick option selected.) All your rules are out of order since the top rule allows everything. That rule should be last, not first. Your problem isn't your rules.

                                          K 1 Reply Last reply Reply Quote 0
                                          • K
                                            keesdek @KOM
                                            last edited by

                                            @kom Thanks again for your help!
                                            I tried 'johnpoz' (above) order first, but since it didn't work then, I started changing the order...

                                            KOMK 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.