[SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set

Sergei_Shablovsky · Nov 13, 2021, 3:56 AM

Dear pfSense Gurus!

How to restoring access to pfSense GUI from LAN interface after Block Private Networks in “Interface” configuration was set?

Is that possible to using pfSense PHP Shell the command ?

     $config['system']['disablefilter'] = true;

If I understand official docs correctly, the Block Private Networks create firewall's rule to block any addresses that mean for private networks ( 192.168., etc). So if I temporarily disable fw from local console, I would be able to connect to GUI thru the LAN interface.

And sub-question are how to check from local console if the incoming access really blocked on LAN and if blocked, which fw rule exactly doing this?

johnpoz · Nov 9, 2021, 11:49 PM

@sergei_shablovsky the antilock out rule should allow traffic before that rfc1918 block rule.. Did you also disable the antilock out?

You can hand the gun on safe, with no bullets even. And users still manage to shoot themselves in the foot ;)

Sergei_Shablovsky · Nov 9, 2021, 11:59 PM

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky the antilock out rule should allow traffic before that rfc1918 block rule.. Did you also disable the antilock out?

Of course, the answer is NO
Before of this I am a little bit disappointed why access on LAN blocked...

You can hand the gun on safe, with no bullets even. And users still manage to shoot themselves in the foot ;)

Perfect phrase! I record it on a wall :)
Just to note, some of users have a bunch of pfSense's installations and other not so smart SysAdmins may be involved in pfSense stable life. ;)

nimrod · Nov 10, 2021, 1:16 AM

@sergei_shablovsky

This can happen if you change default port for accessing web interface. Sometimes you have to type full domain or ip address followed by the port. For example:

https://home.pfsense.arpa:5433

Or

192.168.1.1:5433

This is assuming that your pfSense box is located at 192.168.1.1 and you changed default port to 5433.

Sergei_Shablovsky · Nov 10, 2021, 9:02 AM

@nimrod said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky

This can happen if you change default port for accessing web interface. Sometimes you have to type full domain or ip address followed by the port. For example:
https://home.pfsense.arpa:5433
Or
192.168.1.1:5433
This is assuming that your pfSense box is located at 192.168.1.1 and you changed default port to 5433.

Thank You for suggesting.

No port changed as I knows.

Gertjan · Nov 10, 2021, 9:39 AM

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Of course, the answer is NO

So, the Anti clock out is present (acivated) (first rule)
and
the "Block private networks" rule is also present - on the LAN interface ( ) ....

These two still permit access to the GUI from the LAN interface, using port 80 or 443 TCP using a browser, to 'undo' this situation, as, for example, pfSEnse can't do ant 'DNS' any more for your LAN network.

Really, are there admins out there that activate a "block all RFC1918"(= 192.168.1.0/24 10.0.0. .... and friends) on a LAN type interface ? Maybe there is a valid reason to do so, didn't encounter one yet.
I'll advise the blue pill, just to be sure.

Sergei_Shablovsky · Nov 10, 2021, 10:52 AM

@gertjan said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Really, are there admins out there that activate a "block all RFC1918"(= 192.168.1.0/24 10.0.0. .... and friends) on a LAN type interface ? Maybe there is a valid reason to do so, didn't encounter one yet.
I'll advise the blue pill, just to be sure.

That’s not my mistake. But I need to solve it. ;)

Sergei_Shablovsky · Nov 10, 2021, 10:55 AM

@gertjan said in Restoring access to GUI from LAN after “Block Private Networks” was set:

These two still permit access to the GUI from the LAN interface, using port 80 or 443 TCP using a browser, to 'undo' this situation, as, for example, pfSEnse can't do ant 'DNS' any more for your LAN network.

As I wrote, now I have only access to local VGA console with pfSense “cheap menu”, and I have no access to GUI.

How to solve this problem from VGA console?

Gertjan · Nov 10, 2021, 10:59 AM

@sergei_shablovsky

If it's a recent change, you could :
Backup the config first.
( quick and dirty method, will do if the system is still accesible using the console : copy it to a save place like /root/... )

Now, use the cheap menu and see what option 15 van do for you.

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

But I need to solve it. ;)

Yeah, guess you went for the red a while ago.

johnpoz · Nov 10, 2021, 2:10 PM

Your going down the wrong rabbit whole - if you have the antilock out rule there, blocking rfc1918 is not preventing you from access the gui.. You have something else going on. Like the gui not even running or working maybe?

Sergei_Shablovsky · Nov 10, 2021, 2:10 PM

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

gui not even running or working maybe?

May be... How to see it in system processes, or by other way ? Because this is Nginx work, right?

johnpoz · Nov 10, 2021, 2:17 PM

@sergei_shablovsky what port is gui listening on?

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: sockstat | grep :8443
root     nginx      61483 6  tcp4   *:8443                *:*
root     nginx      61483 7  tcp6   *:8443                *:*
root     nginx      61230 6  tcp4   *:8443                *:*
root     nginx      61230 7  tcp6   *:8443                *:*
root     nginx      60962 6  tcp4   *:8443                *:*
root     nginx      60962 7  tcp6   *:8443                *:*
[21.05.1-RELEASE][admin@sg4860.local.lan]/root:

You know you can just reset all of that from the console menu, and even just rollback to previous config.

Sergei_Shablovsky · Nov 11, 2021, 4:38 AM

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky what port is gui listening on?

from default pfSense installation, SHTTP

You know you can just reset all of that from the console menu, and even just rollback to previous config.

I know, thank You!
But the SysAdmins that make reinstall from USB memstick (with Restore from config.xml function), cannot save any configs history. :(

johnpoz · Nov 11, 2021, 5:14 AM

@sergei_shablovsky not talking about that - just use the restore config feature from console menu

Sergei_Shablovsky · Nov 11, 2021, 6:52 AM

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky not talking about that - just use the restore config feature from console menu

No any backups exist. Because reinstall by SysAdmin from USB memstick.

Sergei_Shablovsky · Nov 11, 2021, 6:54 AM

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

We move far away from initial post. ;)
Is this help in my situation?

Sergei_Shablovsky · Nov 11, 2021, 7:19 AM

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

what port is gui listening on?
80

And also

sockstat | grep nginx

give me both 80, 443 for tcp4/tcp6

johnpoz · Nov 11, 2021, 11:32 AM

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is this help in my situation?

yes because you have console access.. Roll back - but again, if you have antilock out enabled, doesn't matter if you block rfc1918.. Since the antilockout would allow it before that rule would be evaluated.

stephenw10 · Nov 12, 2021, 2:12 AM

If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

Steve

Sergei_Shablovsky · Nov 12, 2021, 2:13 AM

@stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

After several messages we come to my initial question:

Is that possible to using pfSense PHP Shell the command ?

     $config['system']['disablefilter'] = true;

for disabling pf temporarily?

You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

Which exactly line?
(Sorry my stupidness)