pfblocker is blocking my own PFsense web interface from clients on my network
-
tried from my PC and the error below appears
unsure why exactly. it appears to be a similar issue to here:
https://forum.netgate.com/topic/152480/local-lan-traffic-blocked
but I don't see what the resolution was?been using pfsesne for years with no real dramas
only thing I can think of that may have thrown things into an uneasy state:
recently got a starlink as a secondary/backup ISP.
I have a spare pfsense hardware that I have configured up with same IP address and ranges.
as part of testing I connected these clients to the starlink network (via the 'other' pfsense unit).
starlink and other pfsense is now powered off.. has been for a few days, but this is the first time I've tried connecting to the web interface of my normal (prod) pfsense since that was set up.
I just tested on my phone (which never connected to web interface of other pfsense, but may have some arp cache maybe.. from using it as a gateway?)
also tested on a third laptop client.. same issueI do have ssh access.. but not sure how to clear/disable what it is I need to get access back to the web interface.
can still surf web fine.. just cannot control the pfsense via web -
@rocklander if you’re seeing the pfB block page on the LAN IP that would mean pfB’s web server was configured to listen on LAN:443 (and/or 80) thus nginx can’t. Typically pfB listens on a dummy virtual IP set on localhost.
Can you use ssh to revert to a configuration file from before that?
-
@SteveITS
thanks. yes I have ssh to the shell and have tried reverting to a (much) earlier config.
that also really confused me as to why it was still failing after that restore :-/ -
Normally - by default :
this can't happen, as the pfBlocker 'DNSBL' web server listens to :
( all default setting ) :
The "pfBlocker 'DNSBL' web server" listens on port 80 and 443, but only on 127.0.0.1, and that's a interface you can't reach from LAN.
Before : (changed recently) : pfBlockerng created a "Virtual IP", the shown "10.10.10.1" which is reachable on every LAN interface, and this IP is redirected to the "127.0.0.1".
These days - if your pfSense is recent (what version are you suing ?) then you have to create a VIP yourself first - here :
and use (assign) that one into the pfBLockerng DNSBL settings.
Btw : You use an IP = 10.0.9.254 (=pfSEnse)in your browser and that is not a host name, so no DNS is needed to access it, so the DNSBL part (of pfBlockerng) isn't even used.
pfBlockerng can can block IP addresses and networks, but that has nothing to do with the "pfBlocker 'DNSBL' web server".You've ssh access : here is 'what I would do' :
Get the pid of the DNSBL web server :[26.03-RELEASE][root@pfSense.bhf.tld]/root: ps aux | grep light root 88483 0.0 0.3 23540 11008 - S Wed04 0:11.53 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.confso, for me :
kill 88483Then, back to the main ssh menu, and restart the pfSense GUI with option 11.
Now you should be able to access the pfSense GUI.
Review your pfBlocker DSNSBL web server settings. -
@Gertjan said in pfblocker is blocking my own PFsense web interface from clients on my network:
Normally - by default :
this can't happen, as the pfBlocker 'DNSBL' web server listens to :
( all default setting ) :The "pfBlocker 'DNSBL' web server" listens on port 80 and 443, but only on 127.0.0.1, and that's a interface you can't reach from LAN.
Before : (changed recently) : pfBlockerng created a "Virtual IP", the shown "10.10.10.1" which is reachable on every LAN interface, and this IP is redirected to the "127.0.0.1".
These days - if your pfSense is recent (what version are you suing ?) then you have to create a VIP yourself first - here :
and use (assign) that one into the pfBLockerng DNSBL settings.
Btw : You use an IP = 10.0.9.124 in your brower and that is not a host name, so no DNS is needed to access it, so the DNSBL part (of pfBlockerng) isn't even used.
pfBlockerng can can block IP addresses and networks, but that has nothing to do with the "pfBlocker 'DNSBL' web server".You've ssh access : here is 'what I would do' :
Get the pid of the DNSBL web server :[26.03-RELEASE][root@pfSense.bhf.tld]/root: ps aux | grep light root 88483 0.0 0.3 23540 11008 - S Wed04 0:11.53 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.confso, for me :
kill 88483Then, back to the main ssh menu, and restart the pfSense GUI with option 11.
Now you should be able to access the pfSEnse GUI.
Review your pfBlocker DSNSBL web server settings.thanks for this.. attempted to do same, but it seems the process may be dying and restarting with a new PID each time.. feels like it's pretty unhappy .. is there a way I can disable it in startuup (unsure if it's init.d or something else)?
-
said in pfblocker is blocking my own PFsense web interface from clients on my network:
@Gertjan said in pfblocker is blocking my own PFsense web interface from clients on my network:
Normally - by default :
this can't happen, as the pfBlocker 'DNSBL' web server listens to :
( all default setting ) :The "pfBlocker 'DNSBL' web server" listens on port 80 and 443, but only on 127.0.0.1, and that's a interface you can't reach from LAN.
Before : (changed recently) : pfBlockerng created a "Virtual IP", the shown "10.10.10.1" which is reachable on every LAN interface, and this IP is redirected to the "127.0.0.1".
These days - if your pfSense is recent (what version are you suing ?) then you have to create a VIP yourself first - here :
and use (assign) that one into the pfBLockerng DNSBL settings.
Btw : You use an IP = 10.0.9.124 in your brower and that is not a host name, so no DNS is needed to access it, so the DNSBL part (of pfBlockerng) isn't even used.
pfBlockerng can can block IP addresses and networks, but that has nothing to do with the "pfBlocker 'DNSBL' web server".You've ssh access : here is 'what I would do' :
Get the pid of the DNSBL web server :[26.03-RELEASE][root@pfSense.bhf.tld]/root: ps aux | grep light root 88483 0.0 0.3 23540 11008 - S Wed04 0:11.53 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.confso, for me :
kill 88483Then, back to the main ssh menu, and restart the pfSense GUI with option 11.
Now you should be able to access the pfSEnse GUI.
Review your pfBlocker DSNSBL web server settings.thanks for this.. attempted to do same, but it seems the process may be dying and restarting with a new PID each time.. feels like it's pretty unhappy .. is there a way I can disable it in startuup (unsure if it's init.d or something else)?
further update.. I managed to find an even earlier config to restore.. this has given me console back. thanks for all the assists and advice folks.. I'll see what I can break next.
-
@rocklander that is not the pid of the process running you were looking for with light, that is just the pid of your command you just ran.
example
[26.03-RELEASE][admin@sg4860.home.arpa]/root: ps aux | grep light root 23444 0.0 0.0 14196 3036 0 S+ 07:12 0:00.00 grep light [26.03-RELEASE][admin@sg4860.home.arpa]/root: ps aux | grep lshjldfjsdf root 26923 0.0 0.0 14196 3040 0 S+ 07:12 0:00.00 grep lshjldfjsdf [26.03-RELEASE][admin@sg4860.home.arpa]/root: ps aux | grep nginx root 2626 0.0 0.9 163140 72344 - I 07:20 0:08.56 php-fpm: pool nginx (php-fpm) root 8315 0.0 0.8 154752 64384 - I 07:22 0:04.42 php-fpm: pool nginx (php-fpm) root 14467 0.0 0.8 156800 68640 - I Sat05 0:13.71 php-fpm: pool nginx (php-fpm) root 28530 0.0 0.7 125692 58284 - I 12:29 0:01.53 php-fpm: pool nginx (php-fpm) root 28596 0.0 0.9 165196 74060 - I Sat05 0:26.19 php-fpm: pool nginx (php-fpm) root 49597 0.0 0.8 127740 62684 - I 12:28 0:02.87 php-fpm: pool nginx (php-fpm) root 77033 0.0 0.9 164932 73536 - I 07:21 0:18.64 php-fpm: pool nginx (php-fpm) root 93389 0.0 0.1 35140 11896 - Is 2Apr26 0:00.00 nginx: master process /usr/local/sbin/nginx -c /var/etc/nginx-webConfigurator.conf (nginx) root 93518 0.0 0.2 37700 14192 - I 2Apr26 0:10.44 nginx: worker process (nginx) root 93806 0.0 0.2 37700 14076 - I 2Apr26 0:05.44 nginx: worker process (nginx) root 75998 0.0 0.0 14196 3028 0 S+ 07:13 0:00.00 grep nginx [26.03-RELEASE][admin@sg4860.home.arpa]/root:Notice nothing found with light or gibberish with the grep.. but if I look for something actually running it lists all the processes and their pids, notice at the bottom it also shows my command pid 75998
-
@rocklander
Euh ... oh .. lolWhen you execute a
ps aux | grep lightyou execute two things : first the "ps aux", this will list all current system process.
Instead of looking up the right process, and knowing that pfBlockerng uses a web server that isn't 'nginx' but "/usr/local/sbin/lighttpd_pfb" = lighttpd_pfb I add the 'pipe and then grep 'light'.
My example shows clearly that for me, it showed a result.
There is also a second result, a process with 'grep' on the same command line :
That's the grep command itself itself with the 'light' text a paramter.
Disregard this one, as that is not the pfblocker's web server.
Trying to kill a process that has already finish, that doesn't work out.I have to think about this one, as things are strange :
You have the "pfblockerng dnsbl web server" running.
But it isn't shown in the process list ....Ok -- happy enough, Johnpoz didn't found that line (=process neither.
So, question : for the "pfblocker's web server" to be started by pfBlokcerng, you have to use (actived) DNSBL first :
and with this one stopped :
I don't find the "pfblockerng dnsbl web server" neither = it's gone.
But in that case you can't access/get/see this :
.....
-
@Gertjan yeah I don't run dnsbl service, I just use pfblocker for alias creation that I use in my own rules.
Just wanted to explain what he was seeing with this ps command, it didn't find anything via his grep
