No web gui after updating 24.03
-
@4eanlss said in No web gui after updating 24.03:
I instead get a web page for a login of my ISP devices.
Sounds like your behind a double nat, or your doing something with nat reflection and trying to access your public IP from the lan side which is really on your isp device..
I find it highly unlikely that someone out on the internet going to your IP would end up hitting some upstream isp equipment webgui along the path to your IP webgui. Your local isp equipment with your actual public IP on, sure that would make sense.
-
I have the same problem when I update to the latest version.
It finished normal but never comes the console back.
I have a simple connection ISP-FW-LAN Port-PC.
I can log into the fw with simply opening a shell.Nothing in the logs to be found. I also saw that the LE CA's are gone.
My certificates are there but not the CA's. Could this also be the root cause of the issue? -
@rbron01 So your using LE for your webgui?
What exactly happens - does it just spin and spin in your browser and then say timeout, what error happens in your browser - does it just show a white page?
If you have console or ssh access, just reset the the gui to default listening on 80 without any ssl, does it work then?
-
When the update finished it says reloading in xx seconds.
Then when i start a new tab it starts spinning and gives a timeout
Did not try to do a port 80
-
@rbron01 yeah if you run into any sort of craziness with the web gui, you should always be able to fall back to just basic port 80.. I believe its after you reset your webgui password, it asks if you want to fall back to 80.. I think it also asks that if you from the console change your lan IP, which you could just change to whatever it is currently, etc.
Been a while since actually used or played with those options.. Could fire up my VM and see, not in the mood to try and reset my actual webgui ;)
-
@johnpoz Changed from HTTPS to HTTP and the port to 80
Done an upgrade and as usual no more Webgui
It started and is doing traffice but nothing else
-
@rbron01 is there any way you could be running into the bound to interface change in states vs floating.. Your just hitting pfsense lan IP from device on your lan right..
Are you doing anything with policy routing or vpn client or ipsec connections?
-
@johnpoz I have no policy routing nor vpn/ipsec stuff.
Just plane in out traffic.
Also get a timeout when trying,
-
@rbron01 do you show your webgui even running?
[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: netstat -an | grep .8443 tcp6 0 0 *.8443 *.* LISTEN tcp4 0 0 *.8443 *.* LISTEN [23.09.1-RELEASE][admin@sg4860.home.arpa]/root:Mine listens on 8443.. Since you reset to 80 you should see it listening on 80
you should see nginx running on your port
[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: sockstat | grep :8443 root nginx 23204 5 tcp4 *:8443 *:* root nginx 23204 6 tcp6 *:8443 *:* root nginx 22940 5 tcp4 *:8443 *:* root nginx 22940 6 tcp6 *:8443 *:* root nginx 22793 5 tcp4 *:8443 *:* root nginx 22793 6 tcp6 *:8443 *:* [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: -
@johnpoz
Got the same but then with port 80 -
@rbron01 you don't have the antilock out rule disabled do you and some rule that would block? Or didn't put the blockrfc/bogon on your lan interface?
When your consoled/ssh in, if you run a curl to say loopback, do you get the page?
curl http://127.0.0.1
if I tell curl to just don't care about trusting the ssl, i get this for example
[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: curl --insecure https://127.0.0.1:8443 <!DOCTYPE html> <html lang="en"> <head> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="/vendor/bootstrap/css/bootstrap.min.css" type="text/css"> <link rel="stylesheet" href="/css/login.css?v=1701893452" type="text/css"> <title>sg4860 - Login</title> <script type="text/javascript"> //<![CDATA{ var events = events || []; //]]> </script> <script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script><script type="text/javascript">var csrfMagicToken = "sid:28ec30f520e1d8cf9085d5f5bd6398cca1521f01,1714682436;ip:9e433f3ab86fa2f558df408437777ed99de1cad1,1714682436";var csrfMagicName = "__csrf_magic";</script><script src="/csrf/csrf-magic.js" type="text/javascript"></script></head> <body id="login" > <div id="total"> <header> <div id="headerrow"> <div class="row"> <!-- Header left logo box --> <div class="col-sm-4">If that is working, that says hey httpd is serving up the page, but for some reason your client is not getting there, it for sure is listening for example.
-
@johnpoz
I get a page back. However when I connect direct a laptop on the port nothing happens only the timeout -
@rbron01 hmmm that really points to a problem with rules then.. If you try your IP in that curl command you still get a page right..
For grins I would change the state to floating mode vs interface binding. And you have not rules in floating, and lan rules are just the the default any any?
When you connect a laptop to the port, you get an IP right, your not doing anything with vlans were your tagging stuff. You can ping through on the laptop to the internet, you can ping your lan IP, that sort of thing.
-
When i do curl http://10.10.1.1 it comes up with the page
I do not have vlan or taggings.
No rules in floating but I have rules on LAN but these are the std blocking stuff between different networks. I have WAN, LAN and IOT.Tomorrow I will do some more testing now going to bed :)
I will role it back and make a screenshot of the LAN rules for you.
Anything else you may want to have a screenshot off?Thanks for your great help :)
-
@rbron01 said in No web gui after updating 24.03:
but I have rules on LAN but these are the std blocking stuff between different networks
Wouldn't matter if you had zero rules - as long as you didn't disable the antilock out rule you should be able to get to the gui, you didn't turn that off did you? Please post the rules on your lan.. For example here is mine.
And you have no rules in floating tab?
-
@planetinse That's exactly my case...al working.. update.. no GUI but all working hehehe
-
@rbron01 said in No web gui after updating 24.03:
I will role it back and make a screenshot of the LAN rules for you.
Ah yeah kind of hard to do a screenshot of the rules without a gui ;) doh!!
Do you have this rule?
[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: cat /tmp/rules.debug | grep anti- pass in quick on igb0 proto tcp from any to (igb0) port { 8443 22 } ridentifier 10001 keep state label "anti-lockout rule" [23.09.1-RELEASE][admin@sg4860.home.arpa]/root:This is the rule that should allow you to access the gui, it should list the ports no matter your other rules.
You can look at your rules without a gui by looking in that /tmp/rules.debug file.. I would ask you to upload the file - but you might want to walk through it before you do - because it could have your public IP in it.
-
Hi the strange thing is I have a powerline network when I plug this one from the ISP to my LAN port everything works as expected.
The powerline has WLan power and hangs as a "Dirty Internet" line.
The rule is in place.
-
@rbron01 said in No web gui after updating 24.03:
when I plug this one from the ISP to my LAN port everything works as expected.
What? Oh your sure your interfaces didn't switch? You saying when you put your internet into what you believe is the lan, it works.. That says your wan is your lan and your lan is your wan.
I would validate with say looking at the menu that the correct interfaces are assigned to what they should be assigned too.
You could do that with ifconfig, or just the pfsense menu should show you what interface is assigned to what.. So your previous wan wasn't getting dhcp either from your wan?
This is VM - yeah that can happen where the interface order changes.
-
Same thing happened. No WebUI and no DNS.
I had to revert to a backup config made right before the upgrade and reboot. WebUI and DNS came back.
