Management on Second Interface

[wisesongs]

I would like to configure my Opnsense computer while it is connected to the LAN, but not functioning as a router. I planned to do this by disconnecting the cables on the WAN and LAN interfaces, then accessing the WebGUI over a cable connected from the switch to the OPT1 interface. I assigned the LAN interface to 192.168.0.1 and OPT1 to 192.168.0.10.

After I configured the firewall rules to allow access to the WebGUI on OPT1/ 192.168.0.10, I connected the cable to OPT1 and I could open the WebGUI. Then a strange thing happened when I removed the LAN cable, I could no longer access anything on the OPT1 address. With the LAN cable in place and the OPT1 cable removed I cannot reach the OPT1 address, so the only way I can use OPT1 is with both cables in place.

Any ideas what is wrong and how to fix it?

[hbc]

You need to enable GUI on OPT1. Per default it only listens on LAN.
It's a setting somewhere in System: Settings: Administration listen interface

[banym]

And of course allow the traffic form the network to the interface address.
Not sure if the lockout-rule is generated by default if you enable management on that new interface.

[scyto]

I set up opnsense for the first time ever today, in transparent bridge mode (where LAN and WAN are bridged).

Took me ages to work out that I had to set an IPv4 inbound firewall rule on OPT2 where source was OPT2 Network and rest was ANY.

[wisesongs]

banym: thanks for the reply. I tested your advice and tried adding a rule to allow all on the Opt1 interface. I found that it made no difference, I still needed both cables to get a reply from the Opt1 address.

Using the packet capture function, I was able to determine that the query was coming in on the Opt1 interface, and the reply was going out on the LAN interface. It seems very strange that OPNSense is not sending the reply on the same interface as the query.

I suspect that the reply is going to the LAN interface because that is the default route for that subnet and both interfaces have the same subnet assigned. I have no manual routes assigned.

Is there a way to have two interfaces assigned to the same subnet without bridging them? Bridging does not seem to be the right answer because I want the LAN gateway address, and the DHCP, NTP and DNS services, to be inaccessible when the cable is unplugged.

What other information would be helpful for troubleshooting?

[banym]

Hi, maybe you should have look into CARP. That could use two interfaces with the same IP.
That way if one of you interfaces stops working it switches to the second. Maybe this fits your needs?