0

A user rents a cloud server hosted on VMWare and is provided a pfSense appliance to protect it. The pfSense appliance has a web-based login page to access its console. Although pfSense is supposed to protect the rented server, what protects pfSense? Is there another way to remotely manage the firewall other than exposing a web-based login page?

I read this, but it appears to be related to the LAN side. Since the user is renting the server, administration would have to occur from the WAN side.

Would setting up a VPN through pfSense then administering from within there be the only way to do it? If so, how do you protect the VPN's port? Is there a way to lockout certain IP ranges or limit to those you use yourself? What if you have a dynamic IP?

Improve this question
2
  • netgate.com/blog/…
    – gonzobrains
    Commented Apr 30, 2020 at 19:25
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 17, 2020 at 17:17

1 Answer 1

Reset to default
2

I recommend not let the Firewall accessible from the Public IP (both web and SSH access), restrict access only through private networks, and use VPN to access this network and gain access to the firewall management.

You can restrict only known IPs to connect to the ports that your VPN works, but you will lose the flexibility to be anywhere and have access.

Improve this answer
5
  • How do you protect the VPN port then? Since I have RDP open already, could I just use RDP to manage the firewall from the server's web browser? I guess I still have the problem of protecting the RDP port as well.
    – gonzobrains
    Commented Apr 30, 2020 at 20:06
  • To protect an open door of a specific service you need a firewall with "application control" or WAFs in case of access via webGUI (sophos, fortinet, palo alto, cisco and other big players have this feature)
    – Felipe Poyer
    Commented Apr 30, 2020 at 20:28
  • There is another way used on linux servers, using Fail to Ban (or another tool that does the same thing), basically it will block the IP that tries to connect and often miss the password. In the Mikrotiks there is a feature called Port Knocking, to improve the security -> wiki.mikrotik.com/wiki/Port_Knocking I also don't recommend leaving RDP exposed publicly, again VPN is a good way, use VPN to connect to the internal network of your Windows Servers
    – Felipe Poyer
    Commented Apr 30, 2020 at 20:31
  • Does pfSense support these options?
    – gonzobrains
    Commented May 1, 2020 at 3:19
  • Natively no, I haven't worked with pfsense in a long time, you can use an IPS/IDS to improve security (this will increase the consumption of your machine's resources), in pfsense I remember that there is a snort package, good luck! ; D
    – Felipe Poyer
    Commented May 4, 2020 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.