The admin login page open to the internet, closed ten minutes after it was seen
- date
- 20260820
- what happened
- During a same-day address renumber, the reverse proxy moved off the firewalls' own interface addresses onto the pair's shared addresses. Rules written to permit traffic to the proxy on the vacated addresses were not updated, so once the proxy left, they began permitting whatever else was listening there, which was the OPNsense admin interface itself.
- what it cost
- The firewall's own login page, with session cookies, was reachable from the open internet. It was closed within about ten minutes of being noticed. How long it had been reachable before that is not recorded.
- what changed
- The orphaned rules were fixed and the admin interface's listen interfaces were explicitly restricted to the internal side. The empty interface list it had before is silently treated as every interface. More consequentially, the near miss is the direct reason outpost1, a small external machine with no credential to Node0 at all, and the scheduled exposure check that runs from it, were built.
- the check now
- A scheduled scan of Node0's public surface now runs from outside and alarms on anything reachable that should not be. The runbook for the external vantage point describes how it is kept credential-free.
A firewall’s own login page ended up reachable from anywhere on the internet on 20260820, for a time nobody recorded, and was closed about ten minutes after it was noticed, as the fallout of an otherwise routine address renumber. A rule written for one address kept doing something after the service it was written for moved off that address, just not the thing it was written to do. Everything else in the renumber, the outbound translation, the proxy bindings, the second firewall’s own filter rules, had been updated together. One set of inbound rules on the first firewall had not.
The deeper problem the incident exposed is structural rather than a one-time mistake. Node0, like most home and small-site networks, cannot see its own public addresses from inside its own network. A test run from any internal machine reports “cannot verify” rather than “exposed”, and Node0 had recorded exactly that gap, in writing, earlier the same day.
The near miss was caught only because an unrelated project had, hours earlier, put a machine outside the network for a completely different reason, and it happened to be pointed at the right address at the right moment. That is not a plan. It is luck with a lesson attached, and the lesson was taken. Build a small, deliberately credential-less vantage point outside the site and give it a standing job of watching the site’s own public surface the way the internet actually sees it, on a schedule, permanently.
There is a second, smaller lesson underneath it. A daemon’s listen interfaces should be scoped explicitly to match policy, so that a mistake in a firewall rule cannot silently widen exposure. A configuration field left empty is not neutral. In this software it means “everywhere”.
Source: node0 lessons v0.1, lesson 4.3. Sanitized: checklist v0.1, 20260921; public addresses, hosting details; voice pass 20260921. Part of oznog.com/node0.