Never locked out: sign-ins from your own workstation are never blocked after wrong passwords.
Renew address / Reset port: get a new address from your ISP, or restart a port, without restarting the firewall.
Never locked out (trusted sign-in sources)
Korthveil blocks sign-ins after five wrong passwords in 15 minutes, both for the account and for the address they came from, for 15 minutes. This stops password guessing. It can also lock you out of your own firewall after a few typing mistakes.
Addresses you list as never locked out are not blocked. Each wrong password from them still waits 2 seconds before the answer, so guessing from there stays slow.
System › Administration › Management access.
Under Never locked out: sign-ins from these addresses or networks, enter one address or network per line, IPv4 or IPv6, for example:
192.168.2.20: your own workstation;
192.168.2.0/24: your whole LAN.
The panel shows the address your browser connects from and whether it is in the list.
Press Save to pending changes, then commit.
Management access: allowed sources and never-locked-out sources
Good to know:
List only machines you control. A single workstation is safer than the whole LAN: a guest's or an infected device's guesses from a trusted network are slowed down, but never blocked.
Not the same as "Only from these addresses". The field above limits who can reach the web console and SSH at all. Never locked out only changes the lockout after wrong passwords.
Failover pair: the setting is synced, so it applies on both firewalls.
Locked out already? Wait 15 minutes, sign in from a listed address, or sign in with another superuser account and reset the password under System › Administration.
Renew address and Reset port
Network › Interfaces, zones & routes › Interface configuration. Each enabled port has buttons at the end of its row:
Button
Shown on
What it does
Traffic
Renew address (circular arrows)
Ports that get their address by DHCP, such as the internet port
Asks the DHCP server (your ISP's modem) to renew the address now. The answer arrives within a few seconds; the address under IPv4 is updated
Not interrupted
Reset port (power symbol)
Physical ports and VLANs
Takes the link down and up again. On a DHCP port it then asks for an address, with the method that worked last time
Stops on this port for a few seconds
Interfaces: Renew address and Reset port
When to use them:
After changing the modem or the ISP: press Reset port on the internet port, so the firewall asks the new modem for an address straight away.
The internet port shows no address (no answer from the DHCP server yet): press Renew address. If nothing changes, press Reset port.
A switch or access point was replaced on a LAN port:Reset port brings the link up again cleanly.
A message above the table says what was done; every press is recorded in the system log with your name.
Failover pair: the standby holds its internet port down while it is standby (see Two firewalls with automatic failover), so pressing them there does nothing for the internet. Use them on the active firewall.
