Unable to Access WebConfigurator UI and Unable to SSH into pfsense

dougs · Jan 5, 2024, 12:51 AM

Running 2.7.2 for a couple weeks with no issue until a day or two when I noticed that I could not access the WebConfigurator UI nor could I ssh into pfsense. All of the internal users are not affected- all of us can browse the Internet. This came up when I wanted to add an IP address exclusion to pfBlockerNG.

I've restarted the WebConfigurator from the console as well as PHP-FGM. No luck. Also restarted the pfsense box- no dice.

I did see a few days ago that my LetEncrypt certificate failed to renew with roughly three weeks to go. I figured I'd take care of it soon. Does that have anything to do with what's happening here?

I find it strange that not only am I unable to access the Web UI but I cannot ssh into it....

Advice?

stephenw10 · Jan 5, 2024, 1:10 AM

A cert issue would not prevent you SSHing. Is the ssh server enabled? You were able to SSH in previously?

You can check the logs from the command line. I would try to see if the firewall is blocking the connections or if the system log shows errors when you try to start the services.

dougs · Jan 5, 2024, 2:21 PM

Yes, I was able to access sshd previously. The console indicates that sshd is running.

Went through the logs and nothing stands out. Before I reset to default and restore from a backup, is there anything else I should look at?

johnpoz · Jan 5, 2024, 2:33 PM

@dougs if console shows running.. did you try another IP, its possible you blocking or removed the antilock out rule? You could look back through your config changes via console and rollback, or try a different IP, like pfsense wan IP..

if your on the console can you access ssh or webgui via cmd line, if so then points to a firewall rule blocking..

So for example, can you do say something like this.

That shows you that ssh is running and responding, so if you can not get there from a client points to a firewall sort of issue.

Same goes with webgui, you can use curl - do you get a response at all? Using the port your webgui listens on, mine is on 8443 for example

As to rolling back a config change

stephenw10 · Jan 5, 2024, 2:35 PM

You might also have something dynamic blocking you like Snort/Suricata or some pfBlocker update that pulled in a bad list.

dougs · Jan 5, 2024, 6:44 PM

I was able to ssh into the firewall from the console as described above. I also was able to get a response using the curl command as described above.

Yes, pfBlockerNG and Suricata are running on this firewall although Suricata is not in the blocking mode.

I see that there is a command in the console menu (#15) to restore from a previous configuration backup. However, when I list these backups I can only see the last 7 backups and these are one hour apart starting about an hour and 15 minutes ago. How can I see the rest of the 30 backups? The reason for each of the 7 most recent backups that I could see on the screen is "pfblockerNG: saving Unbound custom options". This leads me to suspect there might be something wonky going on with pfblockerNG...

johnpoz · Jan 5, 2024, 6:48 PM

@dougs yeah pfblocker loves to do that - I keep meaning to look into a way to stop it, or change how often it does it.. Part of the reason I changed my number to 100 hehehe

I would consider an update to items in a list or alias to be a config change.. That it makes constant changes to your config backup could be problematic for sure, especially when they happen often.. If it was once a day, or only when you actually interacted with the config via the pfblocker gui, etc.

If you have the antilock out rule enabled, it should be impossible for pfblocker to create a rule that would lock you out.

dougs · Jan 5, 2024, 6:58 PM

There's an anti-lockout rule in place so I shouldn't be locked out. However, I am!

I haven't made any changes to pfblockerNG in days.

It looks like I might need to do a reset to defaults and restore from a backup, yes? I'm fine with doing that as long there isn't any other easier way of remedying this! I just have to work around my wife! She thinks everything is fine as long as she has a working Internet connection! :)

stephenw10 · Jan 5, 2024, 6:58 PM

Yup the anti-lockout rule should apply before anything pfBlocker does if it's present.

dougs · Jan 5, 2024, 7:02 PM

How can I verify if the anti-lock out rule is in effect or not from the console?

dougs · Jan 5, 2024, 7:08 PM

I'm reviewing this page: https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html

If I enable WAN access to the firewall as follows: #pfSsh.php playback enableallowallwan, would this still require that one authenticate in order to access the Web GUI? I don't want to open the door to the whole wide world if such authentication isn't needed!

SteveITS · Jan 5, 2024, 7:13 PM

@dougs Yes it still needs the password.

To be clear the anti lockout rule is a firewall rule...it controls whether the client can connect to the web server or not, not whether one can log in. If you see an SSH prompt or web page then the firewall isn't blocking you.

stephenw10 · Jan 5, 2024, 7:13 PM

Yes you still have to authenticate but doing that adds pass rules on the WAN which you probably don't want as you say.

Try running: pfctl -vvsr | grep -A 4 anti
That will show you if the antilock rules are present and if they are opening states and passing packets.

You can add a pass rule to LAN using easyrule if you have to.
https://docs.netgate.com/pfsense/en/latest/firewall/easyrule.html

Do you use policy routing at all? With gateways set on the rules? That can end up bypassing the firewall itself.

dougs · Jan 5, 2024, 7:57 PM

Running "pfctl -vvsr | grep -A 4 anti" gave me this: https://imgur.com/a/fgXHIEx Looks like the anti-lock out rule is in effect, yes?

I tried:

#easyrule pass lan tcp <my computer IP addr> <firewall LAN addr> 443

Didn't work for both Web GUI and ssh . Is this easyrule only for WAN addresses?

I'm not familiar with policy routing so I would imagine it's not being used here.

johnpoz · Jan 5, 2024, 8:19 PM

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

I'm not familiar with policy routing so I would imagine it's not being used here.

Did you have rules with a gateway selected, or is the gateway just an *

dougs · Jan 5, 2024, 8:22 PM

Not sure. I might have had an alias pointing to the firewall and used that in some rules instead of an asterisk. We use only one ISP so one gateway.

SteveITS · Jan 5, 2024, 8:24 PM

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

The reason for each of the 7 most recent backups that I could see on the screen is "pfblockerNG: saving Unbound custom options". This leads me to suspect there might be something wonky going on with pfblockerNG

Pretty sure it saves a new config every time an update runs. (I would think, because it's regenerating rules)

johnpoz · Jan 5, 2024, 8:26 PM

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

We use only one ISP so one gateway.

Talking about your lan side rules, do you have say your wan_dhcp selected?

example..

See where the gateway is called out - that would be policy routing.

dougs · Jan 5, 2024, 8:28 PM

I don't believe we manipulate the gateway address in that fashion.

johnpoz · Jan 5, 2024, 9:54 PM

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

I don't believe

Prob behoove you to double check, you never know what gets set sometime - I agree normally you wouldn't have this set unless you had a specific reason. But you would be surprised how many posts end up being they are doing PBR is the cause they can't get some other vlan, etc.

And even if you were doing it, it shouldn't prevent access with antilock which would be evaluated first.