[SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set

[Gertjan]

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

Sure thing !
The "pfSense PHP Shell" is like a command interpreter.
No ..... it IS a command interpreter. It's PHP.
So, you have to create the 'script' command file, and then execute it.

Is there a 'playback' file already present ?
Probably not.

use these :

Available playback commands:
     changepassword disablecarp disablecarpmaint disabledhcpd disablereferercheck enableallowallwan enablecarp enablecarpmaint enablesshd externalconfiglocator gatewaystatus generateguicert gitsync installpkg listpkg pfanchordrill pfblockerng_install.inc pftabledrill removepkgconfig removeshaper resetwebgui restartallwan restartdhcpd restartipsec svc uninstallpkg

as a how to do example.

[stephenw10]

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

     $config['system']['disablefilter'] = true;

for disabling pf temporarily?

Yes but I would not do that. Just run at the command line:

pfctl -d

That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

Which exactly line?

		<lan>
			<if>em1</if>
			<descr><![CDATA[LAN]]></descr>
This one =>		<blockpriv></blockpriv>
			<enable></enable>
			<ipaddr>192.168.1.1</ipaddr>
			<subnet>24</subnet>
		</lan>

Steve

[Sergei_Shablovsky]

@stephenw10 said in Restoring access to GUI from LAN after “Block Private Networks” was set:

@sergei_shablovsky said in Restoring access to GUI from LAN after “Block Private Networks” was set:

Is that possible to using pfSense PHP Shell the command ?

     $config['system']['disablefilter'] = true;

for disabling pf temporarily?

Yes but I would not do that.

Could You be so please to explain why exactly? For risky to damage mails .config file in situation when I have no backup copy of it?

Just run at the command line:

pfctl -d

That is a temporary change. As soon as you make any change to the firewall it will re-enable pf.

This enabling access to GUI.
THANK YOU (AND ALL OTHERS HERE!) for suggestions, help and teaching!

Which exactly line?

		<lan>
			<if>em1</if>
			<descr><![CDATA[LAN]]></descr>
This one =>		<blockpriv></blockpriv>
			<enable></enable>
			<ipaddr>192.168.1.1</ipaddr>
			<subnet>24</subnet>
		</lan>

Thank You for explain and patience!
Interesting for ma, place in bookmarks;)

[Sergei_Shablovsky]

May be is would be great to add a page “What to to if You cannot access the pfSense GUI?” in “Troubleshooting” section of official docs?

I more than sure that on the way the pfSense become more and more poplar, then more frequently the situation like this happened because lack of user experience. This looks like logical.

This page may consist of:

• try to rollback to backup copy of configuration from remote/local console, using
• ensure that nginx running and on which port by netstat and
• temporary disable pf
• make restoring from remote backup
• enable pf
• check all working ok

[Sergei_Shablovsky]

@johnpoz said in Restoring access to GUI from LAN after “Block Private Networks” was set:

You can hand the gun on safe, with no bullets even. And users still manage to shoot themselves in the foot ;)

This “Restoring ...” May be helpful, because each time users would be try to “shoot themsefs”. ;)

[stephenw10]

A lot of that is already covered here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

Steve

[Sergei_Shablovsky]

@stephenw10 said in [SOLVED] Restoring access to GUI from LAN after “Block Private Networks” was set:

A lot of that is already covered here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#disable-the-firewall

Steve
Thank You, sorry my lack of expired with official docs. ;)

It anyway, thus certain case (when a SysAdmin check the “Block LAN addresses” and save preferences), not covered in this document.

For example most close to this are Blocked Access with Firewall Rules, but not exactly the same.

[johnpoz]

@sergei_shablovsky What exactly are the rule(s) they enabled. Because I still do not get what the issue is here. When asked if they also disabled the antilock out you stated no.

It is not possible to block your lan network from accessing the gui with the antilock out rule there - that is the whole point of it!!

Sure you can block internet access, and you could block dns doing that - but access to the pfsense lan IP on the gui or ssh port would still be allowed by the antilock out..