If you added your server to a private network for the installion and configuration pfSense, pfSense automatically blocks access to the web interface via the public internet for security reasons. Should you nevertheless need access to the pfSense web interface via the public internet, there are two ways to obtain it:
- Disabling the packet filter
- Allowing access in the firewall
In this tutorial, we'll show you how to use both methods. For security reasons, we recommend that you do not allow access to the pfSense web interface over the public internet in a production environment (by disabling the packet filter).
Disabling the packet filter
pfSense uses a packet filter to prevent access to the WebGUI over the public Internet. You can disable the packet filter via SSH/the console as follows:
Step 1
Connect to your pfSense firewall via SSH or the VPS console (easier).
Step 2
You will be presented with the pfSense console menu. Press 8 to go to the shell.
Step 3
Disable the packet filter with the command:
pfctl -d
You can now connect to the WebGUI via the public internet. This can be useful for the initial setup of pfSense, but is unsafe for everyday use.
Re-enable the packet filter with the command:
pfctl -e
Allowing access in the firewall
A safer method is to create a firewall rule and whitelist access to port 443 for a specific IP address from which you need public access.
Step 1
Log in to the pfSense web interface and click 'Firewall' > 'Rules' in the top menu.
Step 2
Click 'Add' to add a new rule. The left add button adds the rule above existing rules, the right one below.
Step 3
Fill in the new line as in the example and click 'Save'. Make sure that you change the IP address 123.123.123.123 to the IP address from which you want to connect to the WebGUI.
This brings us to the end of this tutorial about granting access to the pfSense WebGUI over a public internet connection.