[SOLVED] WebGUI reachable from other not allowed interfaces

[fastboot]

Hi.

I am a little bit wondering about the behavior of my OPNsense installation.

The WebGUI is reachable from other networks via routing.
System - Settings - Adminstration
=> Listen interfaces: LAN

Surely the firewall would route e.g from WIFI-XYZ to LAN. On top of that it would be allowed if I open the flows.

Do I oversee anything? Is it my setup? Because the LAN interface is not dedicated to a NIC, it's configured as trunk to a switch.

To be honest I was expecting that also only the subnet of LAN would be allowed to connect. Not everything else which has a flow open to anywhere.

The WebGUI is listening on LAN (192.168.1.1 on Port 443) but not on WIFI (10.0.0.1 on Port 443) but it will be still routed for sure.


Is this an expected behavior?

[franco]

If you allow WIFI to access 192.168.1.1 (even if implicitly by allowing all) it will be able to access 192.168.1.1 just fine. That's one of the reasons why this only-bind-to-interfaces-is-more-secure is a myth. The firewall does the job if set up right. Nothing else will.


Cheers,
Franco

[fastboot]

Thanks for the clarification @franco

I set now a floating rule to forbid the flow.

[fastboot]

If you allow WIFI to access 192.168.1.1 (even if implicitly by allowing all) it will be able to access 192.168.1.1 just fine. That's one of the reasons why this only-bind-to-interfaces-is-more-secure is a myth. The firewall does the job if set up right. Nothing else will.


Cheers,
Franco

One remark: But this is a logic thing of OPNsense. In comparison with other FW (e.g Palo Alto, Checkpoint, Cisco ASA, .....) the Subnet of the Mgmt Interface (OOB) won't be routed to other vlans, interfaces.

But still -  Good to know.

[chemlud]

If I have two different interfaces with different subnets there usually is a good reason for this and therefore all (but very limited) traffic between these two interfaces should be blocked. Yes, it needs a block rule, that's **sense 101 ;-)

[fastboot]

If I have two different interfaces with different subnets there usually is a good reason for this and therefore all (but very limited) traffic between these two interfaces should be blocked. Yes, it needs a block rule, that's **sense 101 ;-)

Well... I have a lots of different subnets. And for some clients the traffic is surely allowed to reach the LAN, depending on the use case of the VLAN/Subnet. But I was still surpised, that its just routed.
Like already mentioned, this is a OPNsense design then. Because with any enterprise FW you do not have this behavior. For a good reason.

But maybe an additional Help-Text would be good to make this clear.
"Only accept connections from the selected interfaces. Leave empty to listen globally. Use with care."
This is definitely not that clear. At least not to me. Because the initial connection was not coming from the LAN interface ingress.
If you know this behavior, sure its clear then.

[viragomann]

OPNsense gives you the preset alias "This firewall" to block access to the GUI on all its IPs and similar purposes.
You can use it in floating rules or in interface group rules to cover all sources with only a single rule.