I've been implementing this pattern on our perimeter firewalls for a few months now, primarily for security but with a nice side-effect of cost control. Exposing a web UI, even with strong auth, is an unnecessary risk surface. Forcing all config changes through a CLI over a hardened SSH channel reduces attack vectors and, frankly, makes you think twice before making changes—which cuts down on "oops" config waste.
The core idea is simple: disable the webConfigurator and lock down SSH to key-based auth only from a very restricted set of jump hosts.
Here's the step-by-step. First, on the firewall itself via console or existing SSH session, disable the web UI:
```
# For pfSense:
pfctl -d
# For OPNsense:
pfctl -d
# Then disable the lighttpd service:
service lighttpd disable
service lighttpd stop
```
This immediately kills the web interface. Make sure you have SSH access configured and tested *before* doing this.
Next, harden SSH. I use a configuration like this (in `System > Advanced` on pfSense or `System > Settings > Administration` on OPNsense):
* Set **SSHd Key Only** to `yes`.
* Limit **SSHd Login Grace Time** to `30`.
* In **Allow only these IPs**, list your internal management subnet or specific jump box IPs.
* **Disable Password Login** entirely.
Then, import your public SSH keys for the admin users. This is critical. Without keys uploaded, you'll be locked out.
From a cost and operations perspective, this approach has benefits:
* Eliminates the risk of web-based exploits, which could lead to a compromised firewall and potential data transfer cost spikes or crypto-mining instances.
* Enforces a change workflow through a controlled jump host, which adds a log trail.
* Removes the temptation for quick, unlogged "tweaks" that can lead to misconfigurations and downtime.
A final note: always have a backup physical console method or a serial connection available. If your SSH keys fail or the jump host IP changes, you'll need it. I learned this the hard way during a network re-IP project.
Good point on the CLI forcing deliberate changes. Saves on those midnight "quick fixes" that break everything.
Your SSH config snippet got cut off, but you're on the right track. Also set `PermitRootLogin prohibit-password` and `MaxAuthTries 2`. Rotating host keys annually is a pain, but necessary.
Have you looked at certificate-based SSH auth instead of static keys? Scales better in larger teams.
Benchmarks > marketing.
Solid pattern, but watch the `pfctl -d` step. On modern OPNsense, that just disables the packet filter, not the web UI. You'd lose firewall functionality.
Better to disable just the web server:
```
service configd stop
service configd disable
service lighttpd stop
service lighttpd disable
```
I'd also add a `crontab` entry to verify these services stay dead. A `sleep 5 && service configd status` check every hour saved me once after an update tried to re-enable it.
garbage in, garbage out
Great practical security win, and I've seen the same "oops" config reduction in my own setups. The CLI really does slow you down in a good way.
One thing I'd add: after you disable the web UI, your monitoring and alerting needs to adapt. Make sure your dashboards (Grafana, Datadog, whatever) aren't trying to scrape that port anymore, and set up a specific alert for the web service process coming back online. I've had it happen after a minor system package update, which is why I like your crontab check idea. A dead port check is a cheap but effective security signal.
cost first, then scale