Hi Arun, Yes, we improved our iptable rules and removed default opened ports on the management interface. It is not a bug nor a regression.
If you want to have the port open on management, you just need to add the "portal" daemon on management interface. From the GUI, in the management interface, add portal in "Additional listening daemon(s)" field as it is described in the documentation: https://www.packetfence.org/doc/15.1.0/PacketFence_Installation_Guide.html#_enabling_portal_on_management_interface As, result you should see something like that in your pf.conf: ``` [interface eth0.150] mask=your_mask Ip=your_ip type=management,portal ``` Do not forget to restart the services. Thank you Regards Jeremy Goimard Senior Software Engineer PacketFence<https://www.packetfence.org> - Fingerbank<https://www.fingerbank.org> [Akamai Secure your applications]<https://www.akamai.com/solutions/security> Support:+1-555-183-6031 Akamai Technologies - Inverse 145 Broadway Cambridge, MA 02142 Connect with Us: [https://www.akamai.com/us/en/multimedia/images/custom/community.jpg] <https://community.akamai.com> [https://www.akamai.com/us/en/multimedia/images/custom/rss.png] <https://www.akamai.com/blog> [https://www.akamai.com/content/dam/site/en/images/logo/2024/x-logo.png] <https://x.com/akamai> [https://www.akamai.com/us/en/multimedia/images/custom/fb.png] <http://www.facebook.com/AkamaiTechnologies> [https://www.akamai.com/us/en/multimedia/images/custom/in.png] <http://www.linkedin.com/company/akamai-technologies> [https://www.akamai.com/us/en/multimedia/images/custom/youtube.png] <http://www.youtube.com/user/akamaitechnologies?feature=results_main> ________________________________ From: Arun Kangle via PacketFence-users <[email protected]> Sent: Saturday, July 18, 2026 7:30 AM To: PacketFence-users <[email protected]> Cc: Arun Kangle <[email protected]> Subject: [PacketFence-users] `15.0 → 15.1 upgrade drops port 443 iptables rule on management interface, breaking sponsor activation links After upgrading from PacketFence 15. 0 to 15. 1, the sponsor-based guest activation flow breaks when the sponsor accesses the activation link from the management network. Root cause: The 15. 1 upgrade regenerates iptables rules and only adds port ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization. ZjQcmQRYFpfptBannerEnd After upgrading from PacketFence 15.0 to 15.1, the sponsor-based guest activation flow breaks when the sponsor accesses the activation link from the management network. Root cause: The 15.1 upgrade regenerates iptables rules and only adds port 443 (HTTPS) ACCEPT rules for registration/internal interfaces (eth0.201, eth0.203), but not for the management interface (eth0.150). Port 1443 (admin UI) is correctly added for the management interface. This means sponsors on the corporate/management network cannot reach https://<hostname>/activate/email/sponsor/<code> on port 443, even though the admin UI on port 1443 works fine from the same network. Impact: Sponsor activation links silently fail — the HTTPS connection is dropped by the firewall. The sponsor sees a timeout or "connection not secure" error. Guests are never approved. Affected version: 15.1.0 (ZEN image, Debian 12) Workaround: Add the missing rule manually: # Immediate fix iptables -I INPUT -i eth0.150 -p tcp --dport 443 -j ACCEPT # Persistent fix echo '-A input-management-if -p tcp --dport 443 -j ACCEPT' > /usr/local/pf/conf/iptables-input-management.conf.inc Expected behavior: The iptables template (iptables.conf.tt<https://urldefense.com/v3/__http://iptables.conf.tt__;!!GjvTz_vk!QoUup4pjvzICx-mUPLJh9T_3nW7RUKA3FNpXMy7tXR5VgtR8lIXxW8klEqGTY48Ecdv6171o9lTuJ6J2NS3NJTIgFBFk7SZ9jV4G4g$>) should include port 443 on the management interface, matching how port 1443 is handled. Thanks, - Arun
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
