Firewall
By default, the Pineapple Pager has a firewall which limits access to the admin interfaces (SSH and the Virtual Pager) to connections made via the USB-C and Management Wifi (if configured) networks.
Why is there a firewall?
The management interface firewall is in place for three main reasons:
- To protect access to your device. When connected in client mode, or when capturing clients via the Pineapple access points, you may not wish to allow any connections from other devices on the network.
- To help remain hidden. Making the Virtual Pager easily discoverable to clients on the open network is an easy loss to stealth!
- To protect access to your device! Thanks to the mess caused by self-signed SSL certificates, meaningfully protecting the Virtual Pager interface with
httpsis essentially impossible. Accessing your virtual pager overhttpfrom an unprotected network can expose your admin password.
Turning off the firewall
Hak5 strongly believes that you own your device and can make your own decisions about security. While we don’t recommend disabling the firewall, you certainly can.
To disable the firewall, make the following change in /etc/config/firewall:
config include
option name 'hak5admin'
option hak5ver '100'
option type 'script'
option path '/etc/firewall.d/admin'
option enabled '1'
To:
config include
option name 'hak5admin'
option hak5ver '100'
option type 'script'
option path '/etc/firewall.d/admin'
option enabled '0'
Then restart the firewall with the command:
fw4 restart
The fw4 command will print warnings about ignored values in the configuration file. This is normal! The Pager uses these placeholder version values to help when applying firmware updates. Most tools ignore these extra values, but fw4 likes to complain.
If you have disabled the admin firewall, you must ensure that your root/admin password is strong and you should never log into the Virtual Pager from an untrusted network, such as the Pineapple Open access point (open networks have no encryption) or from an untrusted network you are a client of (such as a conference network, hotel network, or other network that you have connected to in client mode).