No web gui after updating 24.03
-
@stephenw10
After a few hours testing.. now i can say that i understand where de failure was. If your pass rule is in "Floating rule" when update the firewall will block you because by default update change the metod to Interface Bound States. You must introduce pass rule inside interface tab... that's easy :)All working now.
Thanks Stephenw10 -
@wisepds said in No web gui after updating 24.03:
If your pass rule is in "Floating rule" when update the firewall will block you because by default update change the metod to Interface Bound States
Huh, that might be worth a comment in the release notes...?
-
Hmm, because your floating rule was applied to multiple interfaces? Or was outbound or some other advanced firewall option?
-
@wisepds said in No web gui after updating 24.03:
You must introduce pass rule inside interface tab.
Okay. Same issue here. My configuration was very basic from the beginning purchase of netgate 3100 with no custom rules. How to introduce pass rule without the GUI?
-
@4eanlss there are a handful of suggestions on https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#remotely-circumvent-firewall-lockout-with-rules.
However the default pfSense config is no floating rules and an allow all rule on LAN.
-
Yes still unclear exactly what the floating rule configuration was that failed here. I was unable to replicate it locally. I'd love to know what it was because, I agree, we should document it.
-
@stephenw10 I don't know why.. on floating roules only was "PFblocker" floating rules... i only know that with floating rules all work as intend and when we changed to interface bound States GUI stop working.. i must disable firewall and create this rule to work:
My last rule was * * * * * * * and don't work to access.. when that rule was deleted and create a specifically rule to pass.. all work..
That MV is inside a lan.. in other words.. i access that MV by WAN connexion.
-
Hmm, so just the existence of those floating rules prevented access?
The floating rules created by pfBlocker could well block access from the WAN. It coukld just be the pfBlocker lists pulled in something that blocked your local source IP.
-
@SteveITS Thank you for the information. Greatly appreciated. At this point I will not be able to get the GUI from the WAN IP as my ISP works in a way that I would ultimately be hitting their equipment.
-
@4eanlss said in No web gui after updating 24.03:
I will not be able to get the GUI from the WAN IP as my ISP works in a way that I would ultimately be hitting their equipment
Huh? That would be any and all traffic from pfsense to the internet - that is how isps work, yes your traffic be hitting their equipment. So not sure what your meaning with such a statement.
-
@johnpoz I was referring to the troubleshooting option to "Add an allow all WAN rule from the shell"; however, if I attempt to load my public IP address (https) I instead get a web page for a login of my ISP devices. Maybe I misunderstand what the troubleshooting was indicating to attempt. Regardless, I've compared all my configuration backups xmls and have not found a anit-lockout rule in any from the beginning; so, not sure if a ever had a valid configuration other than I was able to use the GUI interface 4 years until the upgrade.
-
@stephenw10 Since my router is functioning normally in all other regards I'm not that concern at this time. I will become familiar with the console interface and attempt to identify the differences in my configuration before/after the upgrade and post results here.
My configuration only runs two additional services: pfBlockerNG and UPS.
My procedure was:- Shutdown the system from the GUI menu.
- After confirming the system was shutdown, pulled power.
- Pulled the USB from UPS and replace batteries. Note: intent was to do UPS maintenance as well and did not want a forced shutdown by UPS during upgrade.
- Restarted firewall, confirmed all services were working sans UPS (USB still unplugged).
- Made configuration backup.
- Performed an upgrade from GUI.
- After device restarted and after 10-15 minutes of no response from GUI -- realization that GUI access was blocked; however, firewall was allowing inbound/outbound traffic as expected.
-
@wisepds same issue for me webgui not responding after upgrade, but everything is up and running.
Edit: yes for me it was the interface bound state change, after set it to floating - it works again.
-
@planetinse said in No web gui after updating 24.03:
Edit: yes for me it was the interface bound state change, after set it to floating - it works again.
So you have asymmetric routing going on, maybe fix it.
-
Yes, it would be good to know exactly what scenarios are hitting that issue. Especially if it's something unexpected. The more we can add to the docs the better.
-
@4eanlss said in No web gui after updating 24.03:
I instead get a web page for a login of my ISP devices.
Sounds like your behind a double nat, or your doing something with nat reflection and trying to access your public IP from the lan side which is really on your isp device..
I find it highly unlikely that someone out on the internet going to your IP would end up hitting some upstream isp equipment webgui along the path to your IP webgui. Your local isp equipment with your actual public IP on, sure that would make sense.
-
I have the same problem when I update to the latest version.
It finished normal but never comes the console back.
I have a simple connection ISP-FW-LAN Port-PC.
I can log into the fw with simply opening a shell.Nothing in the logs to be found. I also saw that the LE CA's are gone.
My certificates are there but not the CA's. Could this also be the root cause of the issue? -
@rbron01 So your using LE for your webgui?
What exactly happens - does it just spin and spin in your browser and then say timeout, what error happens in your browser - does it just show a white page?
If you have console or ssh access, just reset the the gui to default listening on 80 without any ssl, does it work then?
-
When the update finished it says reloading in xx seconds.
Then when i start a new tab it starts spinning and gives a timeout
Did not try to do a port 80
-
@rbron01 yeah if you run into any sort of craziness with the web gui, you should always be able to fall back to just basic port 80.. I believe its after you reset your webgui password, it asks if you want to fall back to 80.. I think it also asks that if you from the console change your lan IP, which you could just change to whatever it is currently, etc.
Been a while since actually used or played with those options.. Could fire up my VM and see, not in the mood to try and reset my actual webgui ;)
