Remote management

Remote management lets your team open each firewall's own pfSense web GUI and an SSH console from its page in Revo, without allowing management from the internet, not even from one IP address.

How it works

• Firewalls dial out. Each firewall keeps an outbound connection (an SSH tunnel) to your management relay, a small server you run on its own VM. The firewall's GUI and SSH are reached through that tunnel, so they need no internet-facing rule.
• The relay is private. Its web pages are reachable only over your NetBird network.
• Every session needs three things: a link from Revo (which checks your permissions and two-factor authentication), your passkey registered on the relay itself, and being on NetBird.
• You sign in to pfSense yourself. Revo and the relay don't store firewall passwords. You type yours into the relay's window.

This is designed so that even if someone took over Revo, they still couldn't reach your firewalls: Revo has no network path to the relay, never sees passkeys, and can only ever turn a firewall's tunnel off.

Open a firewall

1. Open the firewall in Revo and go to Manage.
2. Click Open GUI or Open SSH console. You may be asked for your two-factor code first.
3. A new window opens on the relay (for example mgmt.example.com). It shows which firewall you're opening, from the relay's own records. Confirm with your passkey.
4. Sign in to pfSense with your own account.

Before you type a pfSense password, check the address bar shows your relay's domain or one of its subdomains. The firewall never opens inside a Revo page, on purpose: an embedded login could be imitated.

The GUI and console windows end after 30 minutes without activity (8 hours at most). The console doesn't record what you type or see; the relay logs who opened which firewall, when and from where, and Revo shows recent sessions on the Manage tab.

Set up the relay (once)

You need an owner or admin in Revo and someone who can create a VM.

1. Create the relay VM and install the relay (Docker). Give it a NetBird peer, a name such as mgmt.example.com in your NetBird DNS (with a wildcard *.mgmt.example.com), and a certificate for both. Forward one TCP port (2222 by default) from your public address to the relay, for the firewalls' tunnels.
2. Register your passkey on the relay. The relay's log shows a one-time setup code. Open the relay's address, enter the code and your email, and register a passkey. Bookmark the relay's address.
3. Connect it to Revo. In Revo, Settings → Firewall relay: enter the relay's address and its event-signing key (from the relay's admin page). Revo then shows its address, a relay ID and a ticket key; paste those into the relay's admin page.
4. Invite your team from the relay's admin page. Each person registers their own passkey.

Add a firewall

The firewall needs collector 1.2.0 or later (it updates itself) and its GUI on HTTPS.

1. On the relay, open Add firewall (the Manage tab links to it) and pick the firewall. The relay shows a one-line command.
2. Run that command on the firewall: Diagnostics → Command Prompt → Execute Shell Command, or an SSH shell. Always copy it from the relay, not from anywhere else: it carries the relay's own identity, so the firewall can only ever connect to your real relay.
3. The firewall prints its tunnel key and the pairing code. On the relay's pairing page, check the code matches, paste the key and approve with your passkey.
4. Within a minute the Manage tab shows the tunnel connected and the Open buttons appear.

Lock the firewall down

The Manage tab checks the latest configuration and tells you what to change:

• No internet-facing rule should allow the GUI or SSH. With the relay you don't need one. Remove or disable any WAN rule that allows them.
• Keep the GUI on HTTPS, with its DNS-rebinding and HTTP_REFERER checks on (the relay works with them).
• Keep login protection on, and make SSH key-only (or turn it off if you don't use the console).

If something changes

• "This firewall's identity changed." The relay saw a different GUI certificate or SSH key through the tunnel, so it stopped forwarding anything. After checking the change is expected (a renewed certificate, a reinstall), a relay admin re-approves the firewall on the relay.
• Turn management off from the Manage tab: the firewall drops its tunnel at its next report. Turning it back on needs the relay's command run on the firewall again. A relay admin can also revoke a firewall on the relay, which drops its tunnel immediately.
• Someone leaves: remove them in Revo and on the relay. Removing them on the relay ends their open sessions at once.