Unable to Access WebConfigurator UI and Unable to SSH into pfsense

johnpoz

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

I'm not familiar with policy routing so I would imagine it's not being used here.

Did you have rules with a gateway selected, or is the gateway just an *

dougs

Not sure. I might have had an alias pointing to the firewall and used that in some rules instead of an asterisk. We use only one ISP so one gateway.

SteveITS

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

The reason for each of the 7 most recent backups that I could see on the screen is "pfblockerNG: saving Unbound custom options". This leads me to suspect there might be something wonky going on with pfblockerNG

Pretty sure it saves a new config every time an update runs. (I would think, because it's regenerating rules)

johnpoz

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

We use only one ISP so one gateway.

Talking about your lan side rules, do you have say your wan_dhcp selected?

example..

See where the gateway is called out - that would be policy routing.

dougs

I don't believe we manipulate the gateway address in that fashion.

johnpoz

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

I don't believe

Prob behoove you to double check, you never know what gets set sometime - I agree normally you wouldn't have this set unless you had a specific reason. But you would be surprised how many posts end up being they are doing PBR is the cause they can't get some other vlan, etc.

And even if you were doing it, it shouldn't prevent access with antilock which would be evaluated first.

stephenw10

@dougs said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

https://imgur.com/a/fgXHIEx

Yes that shows the anti-lockout rules are present on LAN. But also that they have passed nothing; 0 bytes/packets/states.

So either some other rule is passing them. Somehow. Or maybe the traffic never reaches pfSense. Or perhaps it's being forwarded.

You could try running a tcpdump from the CLI while you try to connect to confirm it's at least trying.

johnpoz

@stephenw10 said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

CLI while you try to connect to confirm it's at least trying

could be sending it to something else.. sniff is yeah what I would do - have access to console, sniff on pfsense itself to validate traffic gets there.

dougs

About a week ago, I decided to reset the pfSense firewall to factory defaults from the console menu and left it running without changing any configuration options aside from setting the WAN/LAN interfaces, modifying the console dashboard and creating a DHCP server IP address range. Everything else was left as is.

I was able to access the Web GUI for a couple days. Just 2 days ago, I discovered I could not access it nor could I ssh into it!

Restarting the Web Configurator does not allow me to access the firewall web site.

Executing pfctl -vvsr | grep -A 4 anti shows this:

https://imgur.com/a/J2mbVCx

Tried running: #easyrule pass lan tcp <my computer IP addr> <firewall LAN addr> 443 and it states the rule was successfully created. However, I cannot access the LAN address of the firewall nor could I ping it from the computer IP address. Tried it from another computer with similar results.

Did a zpool scrub pfSense and did not indicate any errors.

Every system on the LAN side can access the Internet normally-- including our Samsung TV sets and an Enphase IoT device among others.

This is on an older Protectli FW6C purchased in 2021. https://protectli.com/wp-content/uploads/2019/01/FW6C-Datasheet-190104.pdf

At this point, I am not sure what else to do aside from reformatting the drive and starting all over again. Please advise.

johnpoz

@dougs and no simple tcpdump?

You could have no rules and completely wide open, still never works if your traffic never gets there..

Your anti lock rule is there.. don't show any states.. Do a simple tcpdump when you try and get there..

stephenw10

Mmm, that sure starts to look like it's just not hitting pfSense at all.

NollipfSense

@stephenw10 said in Unable to Access WebConfigurator UI and Unable to SSH into pfsense:

Mmm, that sure starts to look like it's just not hitting pfSense at all.

Yes, sounds like possibly a bad cable...

stephenw10

Since traffic can still reach external sites I'd say more likely a rogue dhcp server.