How to reach pfSense, OPNsense and router admin pages safely

• Don't allow the web interface or SSH on the WAN (internet) interface, and don't forward ports to them.
• Turn off remote management on consumer routers, the option that opens the admin page to the internet.
• Use a strong, unique admin password, and SSH keys where the firewall supports them.
• Keep the firewall's own software up to date, from its web interface.

Everything below works with those rules in place, because nothing needs to reach your firewall from outside. To confirm that nothing answers from the internet, our open port checker tests ports like 22 and 443 on your own connection.

1. 1

   Step 1: Save the admin page as a web panel

   On the Connections page of the RemoteAccessApp app for Windows, add a web panel with the firewall's LAN address, such as https://192.168.1.1 or https://10.0.0.1. The tab asks about the firewall's self-signed certificate and remembers one you've accepted. Check the certificate the first time rather than clicking through.

2. 2

   Step 2: Add SSH on the LAN address, if you use it

   Turn on SSH in the firewall's settings for the LAN only, preferably with key sign-in. Then add the LAN address as an SSH host and check its key fingerprint against the one the firewall shows on its console.

3. 3

   Step 3: Add a serial console for recovery

   If the firewall has a console port, connect it to a PC with a USB serial cable, then choose Add serial console… from the arrow next to Add host and pick the COM port. Most devices use 9600, 8N1 with no flow control, the default; some use a faster speed, so check the manual.

4. 4

   Step 4: Group your network gear

   Put the firewall, its SSH host, the serial console, switches and access points in a group such as Network, so the next time something's wrong everything is in one place.

Two ways, neither of which opens a port on the firewall:

• Through a PC's screen. Open a PC on your network with RemoteAccessApp, from the app or any browser, and use the admin page in that PC's own browser. The PC makes an outgoing connection to our relay, which the firewall allows like any other outgoing traffic. See remote desktop without port forwarding.
• SSH from the website, through one of your PCs. Sign in to the website, open the firewall's saved SSH host and choose Through my PC: a PC of yours on that network opens the connection to the LAN address. It's free.

Signing in over SSH as the admin user on pfSense or OPNsense usually opens the console menu rather than a shell; the menu has an option to drop to a shell. The terminal tab handles the menu like any other program. Useful commands once you're at a shell:

pfctl -s info
netstat -rn
ifconfig
top

The live Dashboard and Run on hosts… run their commands directly, without the menu. The dashboard reads FreeBSD systems, which both of these are based on, but a user whose login opens a menu instead of a shell may stop it from working. A user with an ordinary shell avoids that.

A serial console works when nothing else does: no IP address, no network, a broken rule. The serial tab has Send break, and you can switch DTR and RTS and log the session to a file.

The cable doesn't have to be on the PC in front of you. With a serial cable on a PC at the site, open a live session with that PC and choose Serial ports on this PC… from the session's terminal menu, or right-click it on the Devices page and choose Serial ports…. This needs control allowed on that PC. See serial (COM port) connections.

Some devices drop pasted text. Type text types it key by key instead, with a careful speed for slow devices.

A home router's admin page is usually at an address like 192.168.0.1 or 192.168.1.1. Save it as a web panel with the user name; Fill sign-in fills in the sign-in form, and Copy password clears itself from the clipboard after a short time. Switches, access points and printers with web pages go in the same group.

Server management controllers follow the same rule: keep them on the LAN and reach them through a PC. There are walkthroughs for Dell iDRAC remote access, the HPE iLO remote console and Supermicro IPMI and iKVM.

For hypervisors on the same network, see managing Proxmox, VMware and KVM hosts from one app, and why their web interfaces shouldn't face the internet either. Windows hosts have their own guide to manage Hyper-V hosts and VMs remotely, and the rest of our remote access guides cover NAS boxes, cloud servers and PCs.

If your account reaches a PC inside your network, protect it like the firewall: turn on two-step verification, and keep each PC's Allow prompt unless unattended access is something you need. See security.