PFsense web admin interface reachable from www, HELP!

[Mithrondil]

I just realized that my pfsense admin interface can be acessed from www by any would be intruder that knows my WAN IP.

I need to fix this ASAP, can anyone help me?

[Derelict]

Delete the firewall rule on your WAN interface that allows the traffic.

[Mithrondil]

Does this look ok?


[Mithrondil]

I just checked, the admin interface is still accessable from WAN with the above WAN rules :(

[Derelict]

Shouldn't be.  Are you sure you're seeing what you think you're seeing?  PM me your outside address.

[Mithrondil]

PM sent.

[cmb]

It's not reachable by WAN with that config unless you have floating rules allowing it. Guessing you're probably trying from inside your network to your WAN IP, which isn't a valid test since that hits your LAN rules, not WAN.

[Derelict]

Yeah.  It's not accessible from the outside.

[Mithrondil]

Step 1:
I disconnected from my home WI-FI network with my mobilephone and started using the public mobile network.

Step 2:
I typed in my WAN adress in the mobilephone webbrowser window and I got the pfsense login window.


[cmb]

Assuming your WAN IP is probably the IP you're posting here from, no, it's not open, as Derelict confirmed. Guessing you weren't disconnected from wireless, or have a VPN into your network. Or your browser cached the login page and doesn't care whether it can still reach it.

[Derelict]

Or the mobile phone provider cached it…

$ openssl s_client -connect 85.X.X.X:443
connect: Operation timed out
connect:errno=60
$ openssl s_client -connect 85.X.X.Y:443
connect: Operation timed out
connect:errno=60