[SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set

Sergei_Shablovsky

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

We move far away from initial post. ;)
Is this help in my situation?

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

what port is gui listening on?
80

And also

sockstat | grep nginx

give me both 80, 443 for tcp4/tcp6

johnpoz

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is this help in my situation?

yes because you have console access.. Roll back - but again, if you have antilock out enabled, doesn't matter if you block rfc1918.. Since the antilockout would allow it before that rule would be evaluated.

stephenw10

If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

Steve

Sergei_Shablovsky

@stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

If you really have no backups there you could just disable pf temporarily, access the gui and remove that. Saving that change will automatically re-enable pf.

After several messages we come to my initial question:

Is that possible to using pfSense PHP Shell the command ?

     $config['system']['disablefilter'] = true;

for disabling pf temporarily?

You could remove that line from the config file you restored and then restore it again from USB by re-rooting with the USB stick attached.

Which exactly line?
(Sorry my stupidness)

Gertjan

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

Sure thing !
The "pfSense PHP Shell" is like a command interpreter.
No ..... it IS a command interpreter. It's PHP.
So, you have to create the 'script' command file, and then execute it.

Is there a 'playback' file already present ?
Probably not.

use these :

Available playback commands:
     changepassword disablecarp disablecarpmaint disabledhcpd disablereferercheck enableallowallwan enablecarp enablecarpmaint enablesshd externalconfiglocator gatewaystatus generateguicert gitsync installpkg listpkg pfanchordrill pfblockerng_install.inc pftabledrill removepkgconfig removeshaper resetwebgui restartallwan restartdhcpd restartipsec svc uninstallpkg

as a how to do example.

stephenw10

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?
     $config['system']['disablefilter'] = true;
for disabling pf temporarily?

Yes but I would not do that. Just run at the command line:

pfctl -d

That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

Which exactly line?

		<lan>
			<if>em1</if>
			<descr><![CDATA[LAN]]></descr>
This one =>		<blockpriv></blockpriv>
			<enable></enable>
			<ipaddr>192.168.1.1</ipaddr>
			<subnet>24</subnet>
		</lan>

Steve

Sergei_Shablovsky

@stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:
Is that possible to using pfSense PHP Shell the command ?
     $config['system']['disablefilter'] = true;
for disabling pf temporarily?
Yes but I would not do that.

Could You be so please to explain why exactly? For risky to damage mails .config file in situation when I have no backup copy of it?

Just run at the command line:
pfctl -d
That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

This enabling access to GUI.
THANK YOU (AND ALL OTHERS HERE!) for suggestions, help and teaching!

Which exactly line?

		<lan>
			<if>em1</if>
			<descr><![CDATA[LAN]]></descr>
This one =>		<blockpriv></blockpriv>
			<enable></enable>
			<ipaddr>192.168.1.1</ipaddr>
			<subnet>24</subnet>
		</lan>

Thank You for explain and patience!
Interesting for ma, place in bookmarks;)

Sergei_Shablovsky

May be is would be great to add a page “What to to if You cannot access the pfSense GUI?” in “Troubleshooting” section of official docs?

I more than sure that on the way the pfSense become more and more poplar, then more frequently the situation like this happened because lack of user experience. This looks like logical.

This page may consist of:

try to rollback to backup copy of configuration from remote/local console, using
ensure that nginx running and on which port by netstat and
temporary disable pf
make restoring from remote backup
enable pf
check all working ok

Sergei_Shablovsky

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

You can hand the gun on safe, with no bullets even. And users still manage to shoot themselves in the foot ;)

This “Restoring ...” May be helpful, because each time users would be try to “shoot themsefs”. ;)

stephenw10

A lot of that is already covered here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

Steve

Sergei_Shablovsky

@stephenw10 said in [SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set:

A lot of that is already covered here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

Steve
Thank You, sorry my lack of expired with official docs. ;)

It anyway, thus certain case (when a SysAdmin check the “Block LAN addresses” and save preferences), not covered in this document.

For example most close to this are Blocked Access with Firewall Rules, but not exactly the same.

johnpoz

@sergei_shablovsky What exactly are the rule(s) they enabled. Because I still do not get what the issue is here. When asked if they also disabled the antilock out you stated no.

It is not possible to block your lan network from accessing the gui with the antilock out rule there - that is the whole point of it!!

Sure you can block internet access, and you could block dns doing that - but access to the pfsense lan IP on the gui or ssh port would still be allowed by the antilock out..