Changing the Admin Port and IP on PFSense
Set up the console on a different port so you can create rules specifically for that port
One of my posts on PFSense, Netgate, and Network Security
Free Content on Jobs in Cybersecurity | Sign up for the Email List
When you set up PFSense you might want to change the admin port PFSense uses. That way you can lock down the administrative IP and port to specific administrative interface, for example. It’s not a good idea to expose the administrative interface to the Internet. If you want to login remotely, login first to a VPN and possibly a bastion host. Then restrict access to the administrative console to the private network associated with either or both of those resources.
Here’s how you can change the port associated with the administrative interface.
Login via the console while testing. That way if you lock yourself out you can restore a prior version easily. This is the documentaiton for PFSesnse but you may have more device specific information if you purchased a Netgate appliance.
Before you change the port, create a firewall rule to allow traffic to that port from the appropriate interface. For example, you plugin a cable directly from your laptop to a specific port on the firewall device. That port is associated with an interface when you navigate to Interfaces > Assignments in PFSense. Perhaps you have named one of your interfaces associate with a port your ADMIN_NET. You can create a rule that allows the ADMIN_NET to access the IP address on which you access the firewall on a specific port number.
Disallow traffic to that port on any interfaces that should not be able to access the management interface. (e.g. the WAN interface or traffic coming from the Internet.)
Next, click the gear icon of the anti-lockout rule at the top of the firewall rules for the management interface.
Change the port for the management UI.
If you want to change the IP address with which the anti-lockout rule is associated you have a couple of options. One is to go through the start up wizard again.
Under the first top menu item click the start wizard option in the list.
Go through the wizard and change the IP address for the device.
Now you should be able to navigate to the PFSense firewall on the IP and PORT you selected with a URL like this:
If you disabled https (not recommended) you would use http instead of https.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
