cmnSense
Download

First steps

A new cmnSense firewall is reachable for management and closed to everything else. These steps name its interfaces, let the inside network out, and save the result.

Log in

Web interfacehttps://<address>/ as admin (installer) or cmnsense-admin (Debian package)
CLI over SSHssh admin@<address> or ssh cmnsense-admin@<address>; every user lands in the CLI, never in a shell
On the consolelog in as root, then run cmnsense-cli for an administrator CLI

The installer creates admin with the password you chose. A Debian package installation creates cmnsense-admin with the generated password in /var/lib/cmnsense/initial-admin-password.

What is open by default

Nothing is routed through a new firewall, and nothing reaches the firewall itself except SSH and HTTPS. Those two are allowed by management-access lan, which keeps them open on the interface named lan whatever the rules say, and on every interface until one is called that. So the first thing to do is to name the interfaces.

A first configuration

The CLI works like an ASA or IOS: configure terminal enters configuration mode, interface selects a port, and end leaves. This session names the inside port lan, gives it an address, lets it reach anywhere, translates it to the outside address and saves the configuration. It assumes the uplink is eth0, already named wan.

ssh admin@edge
edge# configure terminal
edge(config)# interface eth1
edge(config-if)# nameif lan
edge(config-if)# ip address 10.10.0.1/24
edge(config-if)# exit
edge(config)# access-list lan extended permit ip lan:network any
edge(config)# nat (lan,wan) dynamic interface source lan:network
edge(config)# management-access lan
edge(config)# end
edge# write memory
  • ? lists what can come next, Tab completes, and every command can be abbreviated: conf t, int eth1, sh run.
  • no in front of a command removes it; do show ... works inside configuration mode.
  • show running-config | include nat filters any output; long output pages like on a switch.

The web interface edits the same configuration: Interfaces for names and addresses, Firewall for rules and NAT. What you change in one appears in the other.

Running and startup configuration

Every accepted change is applied immediately and written to the running configuration, so it survives a restart of the service. The firewall boots from the startup configuration, which only changes when you save: with write memory in the CLI or Save configuration in the header of the web interface. A change that locks you out is undone by a reboot until it is saved.

What happens to a changeA change from the CLI, the web interface or the API is validated on a copy of the configuration, written atomically to the running configuration and applied to the kernel over netlink. If applying fails, the previous configuration is restored. Every version is kept in the history. write memory copies the running configuration to the startup configuration, which the firewall boots from.CLIWeb interfaceAPI clientvalidateon a copyrunning-configwritten atomicallykernelnetlink, one transactiona failed apply rolls back to the previous configurationwrite memorystartup-configwhat the box boots fromhistorylast 100 versions, who and how

Every version of the configuration is kept, with who made the change and from where; the web interface can compare versions and roll back to any of them.

More users

Give each person their own account. Read-only users can look at everything and change nothing:

edge(config)#
username alice role admin password <a long password>
username ops role read-only password <a long password>
username alice ssh-key "ssh-ed25519 AAAA... alice@laptop"

Passwords need at least 12 characters and are stored as argon2id hashes.

Passkeys

Each user can add passkeys for the web interface from the user menu, after confirming their password, and then sign in with Touch ID, Windows Hello, a phone or a security key instead of a password. Browsers only allow passkeys for a real name over trusted HTTPS, so the firewall needs a host name and domain (hostname, ip domain-name) and a web interface certificate that is not self-signed, for example one from ACME. System › User Manager shows what is still missing.

Next

The features page shows what else the configuration can describe: dynamic routing, VPNs, high availability, DHCP and DNS for the networks behind the firewall, and load balancing.