(SOLVED) Is it normal that browsing to my own WAN-IP shows my Omada controller interface?
from Sunny@slrpnk.net to selfhosted@lemmy.world on 12 Dec 17:17
https://slrpnk.net/post/16091795

Hi there, been working on my selfhosted setup a bit lately and just noticed that if I browse to my own WAN-IP it will show to the public the interfance of my oc200 omada hardware controller. While it does have a login form with username password, id be much more confident if this wasnt public at all. I’ve looked online and in my settings but struggle to find anything related to this. Is it common that this is on be default?

Any pointers greatly appriciated.

Edit: Solved - I panicked without thinking I was on my own lan when checking this…

#selfhosted

threaded - newest

scholar@lemmy.world on 12 Dec 17:21 next collapse

Are you browsing from outside your local network?

Sunny@slrpnk.net on 12 Dec 17:24 collapse

No I wasnt… just realised this, thats a great relief really. Was afraid it had been publicly available all this time.

Learn something new every day :)

scholar@lemmy.world on 13 Dec 09:13 collapse

It’s worth checking from an external network anyway, but I’d be surprised if it was public facing.

TheButtonJustSpins@infosec.pub on 12 Dec 17:21 next collapse

Do you see that only when you’re on the LAN or also when you’re coming in from WAN?

Sunny@slrpnk.net on 12 Dec 17:22 collapse

Ah yeah you’re right, i can only access this interface if I am on my LAN. Tried with hotspot now and it doesn’t “load” - so thats good.

TheButtonJustSpins@infosec.pub on 12 Dec 17:52 collapse

My opnSense box does the same thing. I’d rather get to it via internal IP like pfSense worked. (I assume I can make that happen somehow, but I haven’t researched it yet.)

anamethatisnt@lemmy.world on 12 Dec 17:22 next collapse

First off, check that it is also true when using a device outside the LAN. Easiest would be to check with your phone with wifi off. You probably won’t get to the login.
If you do then it’s time to check firewall settings.

Sunny@slrpnk.net on 12 Dec 17:24 next collapse

Yeah ur right, i was on my LAN and thats why it worked. I only assumed because I was accessing it via my WAN IP it was ‘automatically’ public.

Agility0971@lemmy.world on 12 Dec 23:25 collapse

Wait what?

anamethatisnt@lemmy.world on 13 Dec 03:35 next collapse

Hairpin NAT/NAT Reflection can make the experience of visiting the WAN IP from the LAN a different one then if you do it from somewhere else. Or what is your what?

Fuck_u_spez_@sh.itjust.works on 15 Dec 08:03 collapse

NAT loopback, if supported and enabled, may appear to bypass firewall rules.

Basically, traffic to your public (WAN) IP that comes from inside the network is not subject to the same level of security as outside traffic would be. The last part of the parent comment didn’t quite make sense, though.

Goingdown@sopuli.xyz on 12 Dec 17:24 next collapse

Can you access your wan ip when you are somewhere else than on your own lan?

If not, then this is probably just that your router does firewalling and nat is such order that you can access admin interface from local network via wan address.

If yes, then router has some serious misconfiguration.

Sunny@slrpnk.net on 12 Dec 17:30 collapse

Yeah exactly what happened, i was on my lan thinking WAN IP meant it was public - it was not :P

bigredgiraffe@lemmy.world on 12 Dec 18:34 next collapse

I know you solved it but for anyone that finds this later this feature/behavior is typically called “NAT Hairpin” in case you are looking for a setting to enable or disable, hope this helps!

Harald_im_Netz@feddit.org on 12 Dec 18:36 next collapse

Yeah, I’ve never fixed this issue with my fritz.box, only thing that helps is calling up my DynDNS URL. Is there a better way?

fuckwit_mcbumcrumble@lemmy.dbzer0.com on 12 Dec 18:50 next collapse

In pfSense land it’s called nat reflection. I believe it’s off by default on pfSense, but it makes accessing your own stuff “externally” while inside the network a pain so I’d imagine most devices have it enabled by default.

Sunny@slrpnk.net on 12 Dec 18:50 next collapse

Thanks!

[deleted] on 12 Dec 21:32 collapse

.

possiblylinux127@lemmy.zip on 12 Dec 18:38 collapse

It is just a loopback interface you are seeing.