ebox administration page

[scooke]

Hey,

I installed and configured ebox for openvpn and it is up and running. The problem now is that I can't reach the ebox administration page, unless I connect with a xp client to openvpn. The webpage is than reachable again.
When I turn off the firewall /etc/init.d/ebox firewall stop, the page is also reachable even when I'm not connected to openvpn.


My interface setup:

Name: eth0   
Method: static    
External:yes
   
IP address:192.168.1.33
   
Netmask:255.255.0.0
   
   
Virtual interfaces
Name    IP address    Netmask    Action
         
intern    192.168.1.34    255.255.0.0    

[javi]

Hi,

The access to the administration port is not allowed by default through external interfaces.

If you want to allow it go to: Firewall->Packet filter->Filtering rules from external networks to eBox

And add a rule to allow the "eBox administration" service. Save changes and you are done

[scooke]

With my setup, the external interface is allowed to login on the ebox webinterface... Normally it should be allowed for the internal interface?
If I make connection, then I can login, thus it is at that moment already possible to login via the external interface.
When I disconnect, it can't login on the webinterface. What's wrong with my setup?

tnx

[javi]

Note that the typical installation where eBox is acting as a gateway needs two physical interfaces, one external and one internal. That's the way that eBox has to know that all incoming traffic through a external interface can be potentially evil. If you go with just one physical interface, but you must configure your firewall according to that.

If I make connection, then I can login, thus it is at that moment already possible to login via the external interface.
When I disconnect, it can't login on the webinterface. What's wrong with my setup?

That's the way the iptables conntrack module works, when a connections has been established is always accepted no matter if you add a new rule to deny it. New connections will be dropped though. This is something that we will change in the future using conntrack tools which allow us to "remove" all the established connections once the firewall has been restarted.