Use the project as a CLI

[open-source-culture]

Hello
I'm very appropriating your project, thank you for making it open source.
I wonder if there is a way to use your project as a cli - without sending http requsts to the pfsense.
After all, it's just editing a local xml file.
Is there a simple way to do it? Like disabling the Nginx and work directly with the endpoint files?

[jaredhendrickson13]

No, there's not a simple of way to use this package entirely as a CLI unfortunately. It was considered as a feature early on but the idea was dropped for a couple reasons:

1. Using PHP as a CLI has noticeable differences then when running PHP as a web server. Some features such as the session and server super globals are missing that pfSense itself requires for various components.
2. The API interacts with some complex data structures that don't easily translate to command line arguments. A format such as JSON would likely need to be used for many components. It'd essentially be the same as using curl from the pfSense command line to make API requests to localhost.
3. There is a lot more to it than just editing the XML configuration unfortunately. There are many services that have to be restarted after making calls, and there are lots of backend pfSense functions that are called to apply the configuration that have been designed around PHP running as a web server. There is a lot of uncertainty about how pfSense will handle those functions being called from the CLI as opposed to an HTTP request as intended.

With some modifications, you probably could have the package operate as a CLI by interacting with the Models directly, but many features would likely not work as intended and could cause damage to your pfSense instance. I personally wouldn't recommend it.

[open-source-culture]

Thank you Jared for your fast and elaborate response.
I understand the need of the api as it is.

1. I want however to try converting your project to CLI. Can you please guide me how to do it? I don't have past experience with php, I will appriciate if you could elaborate the stages to do it.
2. Don't you think it is an attack surface to the pfsense to open a managemnet port like this? I'm again trying to find a middle-way: Is there a way to communicate to the api without opening a port? Or a way to minimize the attack surface?

Thank you again

[jaredhendrickson13]

1. I want however to try converting your project to CLI. Can you please guide me how to do it? I don't have past experience with php, I will appriciate if you could elaborate the stages to do it.

This would take a fair amount of experimentation so I wouldn't be able to provide specific steps to do it, sorry. The best I can offer is you'd need to write a PHP command line script that interacts with the API's Model classes directly. I'd recommend using the v2 API Models and the v2 API beta package as they have less reliance on HTTP attributes. Here's an example of interacting with the Model's directly. But again I'll emphasize that both pfSense and this package expect certain HTTP specific information that is missing when you run PHP from the command line. This will result in some behavior being unpredictable and potentially dangerous.

2. Don't you think it is an attack surface to the pfsense to open a managemnet port like this? I'm again trying to find a middle-way: Is there a way to communicate to the api without opening a port?

The API uses the same port as the pfSense web UI, it doesn't open ports that are not already opened by pfSense itself. There is risk associated when using any API, but there are many options for securing this API to help reduce risk.

Or a way to minimize the attack surface?

Yes, there are many security controls provided by this package that allows you to minimize risk. Most of these are configurable under 'System' > 'API' after installing the package.

• Allowed interfaces: The API allows you to select which interfaces are allowed to accept API requests. This can even be used to restrict the API to only accept requests coming from the localhost, or pfSense itself in other words.
• Authentication methods: There are different authentication methods that can be used that help reduce risk. For example, using JWT allows for API tokens to issued which are only valid for a set amount of time.
• Login Protection: Like the pfSense web UI, the API will automatically block clients who make multiple failed authentication attempts within a period of time. This is enabled by default.
• Allowed networks: You can specify which networks are allowed to make requests to the API. If the API receives a request from an IP that is not listed in the allowed networks, the request will be rejected.
• Firewall rules: You can also use regular pfSense firewall rules to restrict who can communicate with your pfSense instance (including the API) on a network level.

With the correct configuration and firewall rules, you could restrict API access to only pfSense itself and just make curl requests to the API from the pfSense command line.

[open-source-culture]

Thank you Jared, I will research more about the matter and will get back to you if I have more questions.
Please keep this discussion open until I finish my research. I will update you here.