Disable/enable rule via SSH
-
Looking to be able to disable or enable a rule via SSH, but I can't get it working.....seems as though despite admin logging via SSH there are not enough priveleges in terms of manipulating rules to be able to do this.
Any ideas?
What I am looking to do is via SSH I want to stop/start my OpenVPN service. A kill switch if you like.
Ian.
-
@IanSJohnston there’s https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#manual-ruleset-editing if you can edit the file.
-
@IanSJohnston https://docs.netgate.com/pfsense/en/latest/development/php-shell.html#svc
-
From what I can see:
- https://docs.netgate.com/pfsense/en/latest/development/php-shell.html#svc
This only works inside the pfSense PHP shell (pfSsh.php). It uses pfSense’s internal service control framework. Normal SSH scripts or batch jobs run in the Unix shell, so the svc playback commands are not available there. Therefore it cannot be used in my application.
- https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#manual-ruleset-editing
This is about recovering access after firewall rule mistakes. It only affects packet filtering rules, not system services. OpenVPN would still run even if the rules were changed, so it does not help with stopping the VPN server.
Ian.
-
@IanSJohnston said in Disable/enable rule via SSH:
OpenVPN would still run even if the rules were changed
Yes but you could block access to it, which I thought was your question about manipulating rules...
-
-
I have abandoned this for now, here's why:
Goal was to create a remote webpage button to enable or disable OpenVPN on a pfSense firewall without logging into the pfSense GUI.
First attempts tried stopping and starting the OpenVPN service remotely using SSH commands such as pfSsh.php playback svc stop/start openvpn, but these reported success while the actual OpenVPN daemon kept running.
Directly killing the OpenVPN process worked locally from the pfSense command prompt but could not be done over SSH because the user account did not have root privileges.
Using pkill openvpn also failed for the same permission reason.The approach was changed to a firewall method by creating a WAN block rule for UDP port 1194 and toggling it together with the existing OpenVPN pass rule.
This successfully enabled and disabled VPN access when executed locally.
A pfSense PHP script was then written to toggle those two rules automatically, and it worked when run from the pfSense GUI.
However, executing the same script remotely via SSH failed because pfSense requires root privileges to write configuration changes using write_config().
The SSH user lacks that permission and the attempt generated a pfSense PHP crash report. My Pfsense user account has admin priveleges.
The VPN rule toggle itself worked, but a safe remote method to trigger it without using the pfSense GUI was not achieved.Ian.
Privacy Policy · Cookie Policy