Dashboard System Information shows firewall IP instead of WebGUI client IP

[Samlink]

Hi,

I have noticed an unexpected behavior in the Dashboard > System Information widget.

The "User" field shows the firewall's own LAN IP address instead of the IP address of the client connected to the WebGUI.

Example:

• pfSense LAN IP: 192.168.0.1
• Client PC IP: 192.168.0.193
• Displayed in the widget: admin@192.168.0.1 (Local Database)

Am I tripping or in the past this showed the client IP?

[johnpoz]

@Samlink that is odd, I don't normally have that part of the system info widget enable. But I just enabled it and shows my client IP

Are you using some reverse proxy or something to access the gui? Pfsense IP on the lan in my case is 192.168.9.253

Link seems like a odd name for a firewall btw ;)

[Samlink]

@johnpoz no I don't have any reverse proxy configured on my network.
Later, I'll check the system_information.widget.php file and possibly run a packet capture to see which source address the WebGUI is actually receiving.

If you have any other troubleshooting ideas I'd be happy to try them.

The hostname comes from The Legend of Zelda series, which I am a big fan of. When I first started using pfSense, I used it mainly as a router, hence the name “link” :)

[johnpoz]

@Samlink Ah ok link from zelda -- thanks for indulging my curiosity..

Your not maybe using some nat reflection thing with true proxy.. Your actually going to your lan IP right, not your wan?

[stephenw10]

Which pfSense version are you seeing that in?

Mmm, seems like it must be some sort of proxying at play....

[Samlink]

@johnpoz yes I'm connecting directly thru the lan interface.
@stephenw10 I'm on 2.8.1.

I recently configured pfblocker and a vpn client to route some specific ip addresses thru it. Can it be something related to these things?

[johnpoz]

@Samlink Hmmm off the top of my head I don't see how routing traffic out a vpn or pfblocker could that. Would seem to me some sort of proxy/redirect thing would be really the only way something like that could show up.

Try turning off pfblocker and your vpn, should be easy enough to test if somehow they are the cause.

edit: just fired up my 2.8.1 vm, and yeah its showing the client IP.

[Samlink]

@johnpoz Tried turning off pfblocker and the vpn but nothing changed 🫤
I'm more curious than annoyed by what's going on ahah

[johnpoz]

@Samlink yeah very odd, curious myself what is going on. You sure you just don't have your ips mixed up? ;) hahah

I would look in your state table..

See if there is some sort of nat going on, etc. What port you hitting your gui on? 80, 443? I have gui on 8443 for example.

[stephenw10]

What IP address are you using to connect to the firewall in the browser?

I might imagine some NAT reflection being in play if the browser is resolving the WAN IP for example. The states should show it though.

[chpalmer]

I have several sites with a mix of Wireguard and OpenVPN tunnels to here.. They all show my local LAN address of my desktop when I log into them..

The only way I can duplicate this is to log into my lab router from the desktop of my primary router over a /30 I have between them..

It shows up there as *******@192.168.253.2 (Local Database)

It does not matter if I use the lab machines tunnel address or its LAN address.. same result.

But my desktop in my case is in a 172.31.125.0/24 subnet. Not quite apples to apples but..

[Samlink]

There is definitely something strange going on:

These are the session states with two PCs connected: my main PC and my work PC.

For some reason, my main PC appears to be connecting through the loopback interface, while the work PC is correctly shown as connecting from the LAN.

So this appears to not be a pfsense problem.

[Samlink]

Found the culprit: Tailscale.

Both the pfSense box and my PC are always connected to the tailnet, but I assumed that since they can reach each other directly over the LAN, Tailscale would be bypassed.

[Gertjan]

@johnpoz

That's also odd but way better looking as the more modern :

[stephenw10]

Nice, yup tailscale would do it!