Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in a situation where I require WAN access to be opened up to the WebConfigurator through pfSense because I do not have another node connected to the same network to access WebConfigurator from the inside. Ideally I would like to just do this in shell and either directly modify pf's config to "allow all" just long enough for me to open up WAN access to WebConfigurator from my IP, or modify config.xml to add that rule manually. Does anybody have any insight into how to accomplish this?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

Try this on the shell to disable PF temporarily:

pfctl -d

Then once you are able to login and create the rules turn PF back on with:

pfctl -e

I've had to do exactly what you describe before when I locked myself out remotely.

share|improve this answer
add comment

If you are using a pfSense installation, use the tools pfSense offers to make changes.
You can go and poke around on the command line, but you shouldn't unless you absolutely need to, and you can make the changes almost as quickly through their GUI as you could on the command line.

A better solution in your case might be to set up a VPN connection and put yourself on the inside network that way rather than punching holes in your firewall. It's more secure, particularly in that you're not relying on time as a defense ("The hole is only open for a few minutes" only works if nobody falls in during that time) and there's no chance of forgetting to close the firewall back up when you're done.
(That link is to OpenVPN setup instructions in the pfSense docs - I assume that's probably the best solution for you to connect a single box to the inside network. There are also PPTP and IPSEC options available if you poke around in the docs.)

share|improve this answer
    
I would have done this - in fact I am trying to setup OpenVPN anyway -but this is a new virtual environment with very limited resources so the pfSense is basically by itself –  tacos_tacos_tacos Jun 26 '12 at 18:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.