Feature: Allow webinterface access from WAN

[m4rcu5]

Hi,

Wen deploying an OPNsense machine in the DC with a simple WAN/LAN setup where the protected (though still non installed) servers are in the LAN and the uplinks are in WAN; You set up the box with a WAN+LAN, in which case you can only access the webinterface on the LAN link.
For these kinds of deployments, it would be nice to have a menu option (on the console) to enable web interface access on the WAN to remotely configure the OPNsense installation.
Similar to the 'allowallonwan' option in the pfSense dev console.

[fichtner]

You can set up a WAN-only deployment that will have the web GUI listening on WAN by default. From there, you can add your firewall exception for WAN and start to add the LAN.

[m4rcu5]

That is indeed the other option when deploying in these situations.
Keep in mind though that you are then saved by the anti-lockout rule on the WAN, until you create a LAN interface, then the rules move to there.
I can work with that as well. Feel free to reject the issue or make it low prio.

[fichtner]

Well, we could widen the anti-lockout to all ports as an additional setting (which is obviously off by default).

[fichtner]

The current behaviour isn't bad at all, even if inconvenient at first. Closing.

[MaximumDamage]

Documentation on Deploying in Datacenter (where LAN will not be accessible)

During installation or afterward, you have to assign WAN only interface
In Shell:

-- in menu press 1 to assign interfaces
--- assign WAN
--- on LAN don't enter anything and press enter
-- reboot

After the reboot, your WebGui will come up.
Goto Firewall > NAT > Port Forward and you will see an Anti-Lockout Rule. This rule is automated and will change once you add LAN. Create your own Anti-Lockout-Rule a static source address is recommended

-- Redirect: No -- Interface: WAN -- Protocol: TCP -- Source: (single host) xxx.xxx.xxx.xxx ( your trusted client ip ) -- Source Port: any -- Destination: WAN address

Add the LAN interface via Interfaces > Assignments or assign interfaces via shell.
You will now see that the default Lockout changed. After setting up your LAN and VPN you will be able to access it through LAN address. So you could delete the rule later on.