Create a rule using shell in fresh pfSense installation to open up WAN access to WebConfigurator

Question

I am in a situation where I require WAN access to be opened up to the WebConfigurator through pfSense because I do not have another node connected to the same network to access WebConfigurator from the inside. Ideally I would like to just do this in shell and either directly modify pf's config to "allow all" just long enough for me to open up WAN access to WebConfigurator from my IP, or modify config.xml to add that rule manually. Does anybody have any insight into how to accomplish this?

Solution 1

Try this on the shell to disable PF temporarily:

pfctl -d

Then once you are able to login and create the rules turn PF back on with:

pfctl -e

I've had to do exactly what you describe before when I locked myself out remotely.

Solution 2

If you are using a pfSense installation, use the tools pfSense offers to make changes.
You can go and poke around on the command line, but you shouldn't unless you absolutely need to, and you can make the changes almost as quickly through their GUI as you could on the command line.

A better solution in your case might be to set up a VPN connection and put yourself on the inside network that way rather than punching holes in your firewall. It's more secure, particularly in that you're not relying on time as a defense ("The hole is only open for a few minutes" only works if nobody falls in during that time) and there's no chance of forgetting to close the firewall back up when you're done.
(That link is to OpenVPN setup instructions in the pfSense docs - I assume that's probably the best solution for you to connect a single box to the inside network. There are also PPTP and IPSEC options available if you poke around in the docs.)

Comments

[tacos_tacos_tacos]

I would have done this - in fact I am trying to setup OpenVPN anyway -but this is a new virtual environment with very limited resources so the pfSense is basically by itself