How to enable/disable webgui via ssh?

Started by jonm, October 23, 2026, 03:19:15 PM

Previous topic - Next topic
Print
Go Down Pages1
User actions
October 23, 2026, 03:19:15 PM
I have a remote site I'd like to be able to access via the GUI but only when necessary. How can I disable/enable it from ssh? Is this possible?
October 23, 2026, 04:45:29 PM #1
If you can do this : https://docs.opnsense.org/troubleshooting/webgui.html
I am guessing stop/disable can be done too ?!

Let us know! ;)
Weird guy who likes everything Linux and *BSD on PC/Laptop/Tablet/Mobile and funny little ARM based boards :)
October 23, 2026, 06:26:39 PM #2
Interesting. From [configctl commands list?], "configctl configd actions", in particular "configctl service ...". I don't know if the GUI would appreciate being stopped and started... I'll let others find out the hard way.
October 23, 2026, 06:28:31 PM #3
If you already have ssh why not reverse tunnel the webgui port through it? Thats very simple and you dont have to ever enable it publicly.
Hardware:
DEC740
October 23, 2026, 07:01:21 PM #4 Last Edit: October 23, 2026, 07:24:54 PM by (MARLOO)
Quote from: jonm on October 23, 2026, 03:19:15 PMI have a remote site I'd like to be able to access via the GUI but only when necessary. How can I disable/enable it from ssh? Is this possible?



Yes. You can stop/start the web GUI from SSH:    but ????why???do you reallly want to ??or is for security  :) ????

configctl webgui stop
configctl webgui start


The cleaner solution is the one Cedrik suggested: keep the GUI not exposed on WAN and access it only through SSH when needed


SSH needs to be reachable only through a secure management path, for example WireGuard, Tailscale, or another VPN. Then create a local tunnel


ssh -L 8443:127.0.0.1:443 root@remote-opnsense

then

https://127.0.0.1:8443


This way the GUI is never publicly exposed, and you avoid the risk of locking yourself out if SSH or the service has an issue.
Hardware: N5105 Intel Celeron  
                       OPNsense | Home Lab | Linux & Home Automation
                               "Secure the network, automate the rest."
October 23, 2026, 11:29:23 PM #5
Quote from: (MARLOO) on October 23, 2026, 07:01:21 PMSSH needs to be reachable only through a secure management path, for example WireGuard, Tailscale, or another VPN. Then create a local tunnel

If a VPN is configured, an SSH tunnel is not needed. Just access the GUI directly over the VPN.
October 23, 2026, 11:54:03 PM #6 Last Edit: Today at 12:24:36 AM by (MARLOO)
Quote from: Greelan on October 23, 2026, 11:29:23 PMIf a VPN is configured, an SSH tunnel is not needed. Just access the GUI directly over the VPN.


You're right. If the WebGUI is reachable over the VPN, no SSH tunnel is needed.

But A user can use both VPN and SSH: the VPN gives secure network access, while SSH provides a remote shell for diagnostics, logs, configuration changes and recovery. The VPN alone lets them reach the WebGUI, but SSH is what gives them terminal access.

I saw your repository and it looks interesting. I'll test it soon to receive notifications on Telegram

Regards,
MARLOO
Hardware: N5105 Intel Celeron  
                       OPNsense | Home Lab | Linux & Home Automation
                               "Secure the network, automate the rest."
Today at 05:52:46 AM #7
Quote from: (MARLOO) on October 23, 2026, 11:54:03 PMBut A user can use both VPN and SSH: the VPN gives secure network access, while SSH provides a remote shell for diagnostics, logs, configuration changes and recovery. The VPN alone lets them reach the WebGUI, but SSH is what gives them terminal access.
I didn't say otherwise xD
Print
Go Up Pages1
User actions