Firefox - The browser must support cookies to login.

TAC57

Can anyone give me info on this message I'm getting when trying to log into pfSense?
I've been trying install pfSense CE on a new machine and have had trouble getting to the GUI. I've tried https://192.168.30.1, http, ....192.168.30:441.

I have turned off Enhanced Tracking Protection in Firefox.

tinfoilmatt

@TAC57 Use a non-cached session.

TAC57

@tinfoilmatt Would that be just a Private Window, or some other setting for that IP address?

johnpoz

@TAC57 I am a firefox guy, and setup quite a few instances of pfsense - vm, etc. over the years and have never seen this.

Did you try another browser would be the simple thing to do - if that works then look to your firefox settings that could be blocking cookies.

Like if you were using this setting

TAC57

@johnpoz Same message when running Chrome. I did turn off uBlock Origin and EFFs Privacy Badger which didn't help.

I can get right into pfSense on one of my backup units just fine with Enhanced Privacy Protection Turned on and Protection settings set to Standard.

stephenw10

Mmm, I don't recall ever seeing that either.

Some date/time issue maybe? Not enough to show a bad cert but enough to expire cookies incorrectly.

Test from a different client device?

TAC57

@johnpoz Any other ideas on this? On the computer I'm running 25.11-RELEASE, everything looks good from the monitor plugged into the pfsesne+ box, the network is running just fine, but GUI on 192.168.30.1:441 times out. I've tried firefox, chrome, brave, and IE.

PS C:\WINDOWS\system32> ping 192.168.30.1

Pinging 192.168.30.1 with 32 bytes of data:
Reply from 192.168.30.1: bytes=32 time<1ms TTL=64
Reply from 192.168.30.1: bytes=32 time<1ms TTL=64
Reply from 192.168.30.1: bytes=32 time<1ms TTL=64
Reply from 192.168.30.1: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.30.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
PS C:\WINDOWS\system32>

When I plug in a backup box running 25.7.1 I can get to the GUI just fine. I also have a box running 2.8.1 that I can access the GUI with no problem.

If I drop the port I get.

johnpoz

@TAC57 so your trying to access pfsense web gui via the vip you created for pfblocker?

Your vip for pfsense shouldn't be pfsense actual IP on the interface.

SteveITS

@TAC57 "times out" is a different report than above...?

Just to check you've changed your web GUI port to 441? And then allowed access by firewall?

https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html
https://docs.netgate.com/pfsense/en/latest/troubleshooting/connect-to-gui.html

The pfB message, though, indicates you've set up .30.1 as the DNSBL VIP for pfBlocker. Generally the VIP is set up on an unused IP address that is attached to localhost, the default being 10.10.10.1. Using your LAN IP seems suspicious in this case.

There is a situation in 25.11 where if pfB is removed and reinstalled it by design no longer automatically creates the VIP again, perhaps you did so using the LAN IP?

TAC57

@johnpoz @stephenw10 I've always accessed pfsense via 192.168.30.1:441, including on this this computer, without problems. After upgrading to 25.11 I ran into this issue.

I only attempted 192.168.30.1 without port 441 out of desperation.

johnpoz

@TAC57 what are you showing as the vip for pfblocker? You haven't removed the anti-lockout rule?

Hitting pfsense lan IP on 80 when you have https setup will normally redirect you to the https port.

Have you tried hitting a different interface of pfsense - say your wan IP from the lan side?

SteveITS

@TAC57 said in Firefox - The browser must support cookies to login.:

I've always accessed pfsense via 192.168.30.1:441

I assume you mean, "on this router." Presumably you've changed the port in https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html#tcp-port, or someone has before you.

I would start by changing the DNSBL VIP address, and check again.

TAC57

@SteveITS The port on my router has always been 441. How do I change the DNSBL VIP address if I can't access the pfSense+ GUI?

SteveITS

@TAC57 Two things that come to mind are to temporarily change the LAN IP address via the console, or https://docs.netgate.com/pfsense/en/latest/config/xml-configuration-file.html#manually-editing-the-configuration.

johnpoz

@TAC57 or try accessing gui on different IP that pfsense has, its wan or another interface.

By default the lan rules are any any - so you can access an IP on pfsense on any port.. The gui listens on all interfaces. Do you know what your wan IP is - typically this would be your public IP.

TAC57

@johnpoz @SteveITS I've reinstalled 25.07.1, loaded my backup config, and I still can't get by this screen when I enter http://192.168.30.1/, http://192.168.30.1:441/, or my WAN IP address.

Would it be a problem that my backup config is from my old (crashed) zimeboard SBC and this is a different computer. So I did get into pfsense once to load by backup, but I can't get back in.

Sorry to be such an idiot but if you reply with something for me to try can it be very specific.

SteveITS

@TAC57 it seems more likely to be a browser problem. Disable all extensions?

What DNSBL VIP was in the configuration file you restored?

TAC57

@SteveITS After doing this I got in - If the client receives a connection reset, first try to restart the GUI server process from the system console, typically option 11, followed by option 16 to restart PHP-FPM.

Where can find the DNSBL VIP.

chpalmer

@TAC57 said in Firefox - The browser must support cookies to login.:

@SteveITS After doing this I got in - If the client receives a connection reset, first try to restart the GUI server process from the system console, typically option 11, followed by option 16 to restart PHP-FPM.

Ive been having issues intermittently signing into my Youtube account with the same cookie BS. My guess is that Firefox has changed something in their code that does not always agree with the way a particular site might deal with handing out cookies.. I can come back an hour later and everything will be fine. Lately it has been better. Just pointing out here that it may or may not come back and cause you some more grief..

johnpoz

@TAC57 said in Firefox - The browser must support cookies to login.:

So I did get into pfsense once to load by backup

Well that screams to me something in your config to be honest.. Like your pfblocker vip?

Or something with that IP? You say you get the same problem when you hit your https://wanIP:441

If you can get into pfsense gui just fine before you load your config.. Then something with changing the port or the IP or something else borked up..