Hello everyone,
I got this lenovo m720q tiny with a 4 port intel nic and installed opnsense on it.
I already assignd the WAN and LAN interface, but eventually i want to delete the LAN interface and move it to VLAN. So i wanted to create an emergency exit on a new interface thats not going to be used unless i lock myself out from the LAN
So i assigned the new interface on a different port, after that i enable it and gave it a static ip, then i set up dhcp for that new interface.
But when i look in the menu assignment i see that the plug on that new interface stays red and te other WAN and LAN are green ( im building it offline for now so WAN is not plugged id)
And even when i plug my pc in that new port i see it get connected but i cant visit the opnsense gui...the page stays loading for a while....and even when i try to ping it from my pc it gets stuck at the first byte.
The LAN interface ip i got that on 192.168.1.1
The Emergency exit port on 192.168.99.1
So i dont know what im doing wrong or missing and can someone help me ?
Thanks!
It's a firewall. Nothing(*) is allowed by default. You'll need to define firewall rules for your new interface to allow whatever you deem appropriate.
(*) there is an anti-lockout rule, but since you have a LAN interface, it will be applied there (only)
I did apply a firewall rule and still nothing happend
I tried it before the rule and after
Action: pass
Interface: emergency exit
Direction: in
Protocol tcp
Port range : 80 to 443
Source: any
Destination: any
Test rule
Quote from: teddybearnemo on July 14, 2026, 04:34:18 PMPort range : 80 to 443
Which port range is this?
You can state the source port and the destination port. Source should be "any", the destination that one your GUI is listening on. Is it 443?
Also range from 80 to 443 is a bad idea. You can create an alias and add both ports to it. So the rule covers 80 + 443.
Also ensure that the new interface is selected in
System: Settings: Administration > Listen Interfaces.
Quote from: teddybearnemo on July 14, 2026, 04:34:18 PMProtocol tcp
Port range : 80 to 443
You set that for the destination port range, not the source. But as @viragomann writes, better to create an alias and use that. Or allow all access to destination 'This Firewall', not sure you want to be restricted in an case of emergency.
Quote from: viragomann on July 14, 2026, 04:55:42 PMQuote from: teddybearnemo on July 14, 2026, 04:34:18 PMPort range : 80 to 443
Which port range is this?
You can state the source port and the destination port. Source should be "any", the destination that one your GUI is listening on. Is it 443?
Also range from 80 to 443 is a bad idea. You can create an alias and add both ports to it. So the rule covers 80 + 443.
Also ensure that the new interface is selected in System: Settings: Administration > Listen Interfaces.
Yes its listening om 443
Im not comfortable making aliases yet, im still new to this, but i will take a look at it tonight, or i change the rule in the firewall
And i will also look into listen interfaces option. Because i dont think i did that.
Quote from: teddybearnemo on July 14, 2026, 05:27:10 PMim still new to this
Then make your life easy by creating a new network and then just clone the Default Allow Any Firewall Rules from LAN to that new network as a start! ;)