Todo #15836: Update MIM docs - pfSense Docs - pfSense bugtracker

Actions

Todo #15836

closed

Status:

Resolved

Priority:

Normal

Assignee:

Category:

Multi-Instance Management

Target version:

Start date:

Due date:

% Done:

100%

Estimated time:

Description

https://docs.netgate.com/pfsense/en/latest/mim/design.html

The controller host must have a static IP address, the other instances can have dynamic addresses.
An FQDN may now be used (with the Advertised Addresses option used by clients to know where to connect to), hence dynamic addresses are allowed.

Enabling Multi-Instance Management
Should this section instead link to "https://docs.netgate.com/pfsense/en/latest/mim/setup.html#enable-multi-instance-management"?
The pfSense software GUI [...] the pfSense software WebGUI
Should these use the same term? There are more references in other pages.
The MIM controller daemon uses multiple ports to accept connections. Two of these are configurable:
The (VPN) Listening Port is now also configurable.
The controller picks a random port to use for the VPN.
This may now be configured with the advanced option Listening Port.
IPv4 Address: [...] IPv6 Address:
These options have been removed; Advertised Addresses is used instead.
JWT Session Expiry Time in Minutes:
Renamed to JWT Session Expiry.
Permit Localhost: [...] Allow Cross-Origin API Requests:
These have been removed from the GUI.
The Multi-Instance Management settings tab also includes status information for the controller daemon.
May be worth clarifying that this is only shown once the controller has successfully started / is running.

In addition to these options, we now have:

Custom Options that allows specifying options not already available in the GUI. The field is new-line separated and options must use the format [section] name = value. For example, [controller] allow_cors = true.
Listening Address and Listening Port which allows binding the MIM VPN service to a specific IP address and port. It does not affect the MIM GUI/API service which still listens on *:8080, *:8443.

The MIM controller does not have any automatic firewall rules
This may lead to some confusion. There is an automatic rule when MIM is enabled to allow traffic on the controltun0 interface used for the MIM tunnel. The tunnel carries MIM traffic after instances have been registered/authenticated.