PfSense Web Configurator – Access to Firewall

Networking & Firewalls
1

I have some users connected to the LAN interface but as the administrator I want to be the only person that can access the Firewall for configuration whiles the other users are blocked to do so. I could have put the users on a separate VLan but from experience when I did that and with the various systems in place that Cisco Management Switches and Windows Active Directory Servers and File Servers, when users are connecting to the Windows File Servers and it takes sometime before documents open and that makes the the users complain. So in order to solve that I had to put the servers and the user computers on the main LAN.

Now I tried setting up a rule in the LAN firewall to allow only my IP to have access to the firewall and block the others but it did not work. I think it was because the Anti-Lockout Rule was enabled. But before I disable that I want to know if my rule will work because I don’t want to be locked out of the system for good.

Disabling Anti-Lockout Rule:

WhatsApp Image 2021-02-03 at 11.11.20 AM
WhatsApp Image 2021-02-03 at 11.11.20 AM1080×659 83.8 KB

Rule to allow only my IP to have access to the Firewall for web configuration:

WhatsApp Image 2021-02-03 at 11.11.43 AM
WhatsApp Image 2021-02-03 at 11.11.43 AM1080×809 44.6 KB

OR I should have these two rules instead
1.

WhatsApp Image 2021-02-03 at 11.16.30 AM
WhatsApp Image 2021-02-03 at 11.16.30 AM1080×809 60.1 KB

WhatsApp Image 2021-02-03 at 11.16.55 AM
WhatsApp Image 2021-02-03 at 11.16.55 AM1080×768 97.5 KB

Counting you guys.
Thanks

2

You would only need the one rule from your third image. For production, make sure there is no rule after that that allows access from the entire LAN. If you have such a rule in place right now and want to test if your new rule works, simply insert it before the “allow all” rule and enable logging (like you did on that screenshot). Then access the GUI again and check the logs. If the event shows up, it’s safe to disable the “allow all” rule.

Also I think it makes sense to name the rule “Allow access from ____” instead of “Block access” because it is a “Pass” rule after all.

3

@paolo thanks for the reply. But which allow all rule are you talking about, because the reference I made to is the Anti-Lockout Rule whichis in the Advance Admin Settings of pfSense.

4

This one:

5

Try the following it should do the job

https://pfsense-docs.readthedocs.io/en/latest/firewall/restrict-access-to-management-interface.html

6

Thanks @neogrid for the link