0

A user rents a cloud server hosted on VMWare and is provided a pfSense appliance to protect it. The pfSense appliance has a web-based login page to access its console. Although pfSense is supposed to protect the rented server, what protects pfSense? Is there another way to remotely manage the firewall other than exposing a web-based login page?

I read this, but it appears to be related to the LAN side. Since the user is renting the server, administration would have to occur from the WAN side.

Would setting up a VPN through pfSense then administering from within there be the only way to do it? If so, how do you protect the VPN's port? Is there a way to lockout certain IP ranges or limit to those you use yourself? What if you have a dynamic IP?

2
  • netgate.com/blog/… Apr 30 '20 at 19:25
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 17:17
2

I recommend not let the Firewall accessible from the Public IP (both web and SSH access), restrict access only through private networks, and use VPN to access this network and gain access to the firewall management.

You can restrict only known IPs to connect to the ports that your VPN works, but you will lose the flexibility to be anywhere and have access.

5
  • How do you protect the VPN port then? Since I have RDP open already, could I just use RDP to manage the firewall from the server's web browser? I guess I still have the problem of protecting the RDP port as well. Apr 30 '20 at 20:06
  • To protect an open door of a specific service you need a firewall with "application control" or WAFs in case of access via webGUI (sophos, fortinet, palo alto, cisco and other big players have this feature) Apr 30 '20 at 20:28
  • There is another way used on linux servers, using Fail to Ban (or another tool that does the same thing), basically it will block the IP that tries to connect and often miss the password. In the Mikrotiks there is a feature called Port Knocking, to improve the security -> wiki.mikrotik.com/wiki/Port_Knocking I also don't recommend leaving RDP exposed publicly, again VPN is a good way, use VPN to connect to the internal network of your Windows Servers Apr 30 '20 at 20:31
  • Does pfSense support these options? May 1 '20 at 3:19
  • Natively no, I haven't worked with pfsense in a long time, you can use an IPS/IDS to improve security (this will increase the consumption of your machine's resources), in pfsense I remember that there is a snort package, good luck! ; D May 4 '20 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.