pfSense Anti Lockout Rule | Setup Guide (2024)

Let’s look into the details of anti lockout rule in pfSense. Bobcares, as a part of our Server Management Services, offers solutions to every query that comes our way.

The Anti-lockout rule in pfSense

pfSense has an anti-lockout rule by default to prevent admins from being locked out of the web interface. We can set it up under Anti-lockout on the System >> Advanced page. This automatically applied rule allows traffic from any source within the network to any firewall admin protocol listening on the LAN IP address.

We must disable it and modify the LAN rules for environments that need more security. So that only an alias of trusted hosts can use the admin interfaces. We can disable it easily by going to System >> Advanced >> Admin Access tab. Check Disable webConfigurator anti-lockout rule. And when we click the Save option, the rule will no longer exist.

How to set up the Anti-lockout rule in pfSense?

We can set up the rules as needed to restrict access to the admin interface. So we are taking an example.

1. Here, we must make a ManagementPorts alias containing SSH and HTTPS ports. Because SSH and HTTPS are used for management.

2. Now, for hosts and/or networks that will have access to the admin interfaces, create an alias.

3. The Alias List will appear then.

4. The LAN firewall rules must then be set up to enable access to the previously identified hosts. Also, deny access to everyone else. There are several methods for this, depending on the context and outflow filtering treatment. Now the firewall rules are configured.

5. Go to the System >> Advanced page and disable the WebGUI anti-lockout rule.

6. Finally, mark the box and click Save.

If the admin interface is no longer accessible after disabling the anti-lockout rule, the firewall rules were not properly set up. Re-enable the anti-lockout rule by selecting Set Interface(s) IP address from the console menu, then selecting Reset LAN IP address. We must set it to its current IP address, and the rule will be re-active immediately.

[Searching for a solution to a different question? We’re available 24/7.]

Conclusion

In this article, we provide the steps to set up the anti-lockout rule on pfSense. We also included the steps from our Tech team to enable/disable it.