Administration accessible with single URL

[czmirek]

I have a home opnsense router with 4 interfaces:

interface0 = WAN, not important
interface1 = 192.168.100.0/24
interface2 = 192.168.101.0/24
interface3 = 192.168.102.0/24

The opnsense web administration gui is available on all interfaces with these addresses:

interface1 = 192.168.100.1
interface2 = 192.168.101.1
interface3 = 192.168.102.1

But I would like to access the opnsense web gui using only a single IP address or URL that works on all of these interfaces. So when I put "http://opnsense.local" in browser I'll get opnsense administration web, regardless on interface to which I'm connected now.

Or perhaps some static IP like "http://192.168.111.111" --- I don't mind as far as it is a single thing that works for all interfaces.

I don't know how to achieve the solution for this problem.

- I can't make a DNS record because a DNS override in UnboundDNS cannot be attached to a specific interface only.
- So I thought some kind of Virtual IP / IP Alias would work...but I couldn't make it work as well.
- No luck with trying to configure 1:1 NAT either.

I would greatly appreciate any advice. Thank you!

[Monviech (Cedrik)]

You can access the OPNsense GUI from any attached interface from any IP address.

Since the OPNsense is your default gateway, all requests from any IP address will be sent to the OPNsense.

You only have to adjust the firewall on that interface to allow any source to destination "This Firewall".

[czmirek]

Yes, I can access OPNSense from all interfaces as I said. The firewall is configured to allow all communication.

I don't have a problem that OPNSense is not accessible. It can be accessed from all interfaces. That is working.

I want to OPNSense to be available on all interfaces using a SINGLE URL --- which can be a single IP address.

So for example, if I do "http://192.168.111.111" I'll get OPNSense in all interfaces. Then I'd be able to make a DNS override so the address "http://opnsense.local" would be also available on all interfaces.

[Monviech (Cedrik)]

But I already said you can use any IP address because the OPNsense is your default gateway.

If you are attached to interface 1 you can reach the IP address of interface 3 too.

[Nortant]

Hi czmirek,

Here is my solution.
You cannot view this attachment.

you can see when I ping this domain, the IP address is my WAN IP address.

Also, you should check the Listen Interfaces.
You cannot view this attachment.

[EricPerl]

I'm afraid the OP is complicating things for no reason.
He should probably pick one interface/IP as the "preferred" way to access OPN and adjust his FW rules to allow that (the simplest is to allow HTTPS to "this firewall" - or the preferred interface address - on all 3 interfaces).

Making a DNS entry pointing to that preferred IP is the next step.
Don't use .local for the OPN domain though. There's an explicit warning about that (it messes up mDNS).
I personally wouldn't use an override on a .com domain. At some point, .home might be more appropriate.

[meyergru]

Maybe DNS is his problem, since records are automatically added for all interfaces. Set Services: Unbound DNS: General -> "Do not register system A/AAAA records" and create a specific DNS override for the DNS name of the OpnSense box yourself.

[Nortant]

I'm afraid the OP is complicating things for no reason.
He should probably pick one interface/IP as the "preferred" way to access OPN and adjust his FW rules to allow that (the simplest is to allow HTTPS to "this firewall" - or the preferred interface address - on all 3 interfaces).

Making a DNS entry pointing to that preferred IP is the next step.
Don't use .local for the OPN domain though. There's an explicit warning about that (it messes up mDNS).
I personally wouldn't use an override on a .com domain. At some point, .home might be more appropriate.

yes, you are right, I changed it to another one, .com domain may cause the conflict.

[Nortant]

Maybe DNS is his problem, since records are automatically added for all interfaces. Set Services: Unbound DNS: General -> "Do not register system A/AAAA records" and create a specific DNS override for the DNS name of the OpnSense box yourself.

Yeah, if I didn't do this, it would always get stuck every several seconds when using a domain URL instead of an IP address.

I also fixed the https security issue :-)

You cannot view this attachment.