Preventing access to WebGUI from WAN?

[fernando36]

After some tinkering with configuration and rules I now have external access to WebGUI.. but I'm unable to revert it.

On Advanced -> webConfigurator , all "disable" options are unchecked.
I use an Alternate Hostname and changed port.

I have no rules on my webGUI port (X) on WAN tab

On Lan I have the following:

ID Proto Source Port Destination   Port Gateway Queue Schedule Description

*    *           * LAN Address    X * * Anti-Lockout Rule

* LAN net * * * Failover none   Default allow LAN to any rule

???

[Nachtfalke]

Check the firewall rules on "WAN" interface.
check your NAT/PortForward rules
make sure you clicked "Apply Changes" on firewall rules and not just only "Save".
Reset the states to make sure there isn't any existing

[fernando36]

@Nachtfalke:

Check the firewall rules on "WAN" interface.
check your NAT/PortForward rules
make sure you clicked "Apply Changes" on firewall rules and not just only "Save".
Reset the states to make sure there isn't any existing

Nothing

I have some other ports open/forwarded but not the WebGUI port

[Nachtfalke]

Are you sure that there isn't any "Anti-Lockout rule" on the WAN interface ?

Perhaps you can post a screenshot of your WAN firewall rules so that we can check what's going on ?

[tim.mcmanus]

Silly question:  Are you testing it from inside your LAN?  I made the silly mistake once of creating a route out another WAN connection (same pfSense box) and tried to access WAN1's external IP address from WAN2, and all I got was the pfSense login page even though I didn't have that port open on the WAN.  Took me about an hour to figure it out.  I had to resort to using my iPad over 3G to test the perimeter of my pfSense box (still do on occasion).

[fernando36]

@Nachtfalke:

Are you sure that there isn't any "Anti-Lockout rule" on the WAN interface ?

Perhaps you can post a screenshot of your WAN firewall rules so that we can check what's going on ?

Maybe not a good idea to post the rules here?

But I don't have any rule on my WebGUI port.

@tim.mcmanus:

Silly question:  Are you testing it from inside your LAN?  I made the silly mistake once of creating a route out another WAN connection (same pfSense box) and tried to access WAN1's external IP address from WAN2, and all I got was the pfSense login page even though I didn't have that port open on the WAN.  Took me about an hour to figure it out.  I had to resort to using my iPad over 3G to test the perimeter of my pfSense box (still do on occasion).

I was testing from a proxy. Confirmed now on 3G I can't access it.