changes

README.md

@@ -89,7 +89,7 @@ The OPNsense page **Services -> RustProxy** exposes the runtime listeners used b
 
 - HTTP listen: `0.0.0.0:8080`
 - HTTPS/TLS listen: `0.0.0.0:8181` (toggleable)
-- Admin listen: `127.0.0.1:9090`
+- Admin listen: `0.0.0.0:9090`
-- Allow remote admin: off by default; enable it when binding admin to a non-loopback address such as `0.0.0.0:9090`
+- Allow remote admin: on by default so the RustProxy panel can be reached from other hosts; OPNsense firewall rules still decide which networks can connect
 
 The service runs as the unprivileged `rustproxy` user and keeps `/var/db/rustproxy` mode `0700`, as required by RustProxy. Package installation restarts `configd` so `configctl rustproxy ...` actions are immediately available even after direct `pkg add`.

docs/FIRST_RUN.md

@@ -146,10 +146,10 @@ After installation open **Services -> RustProxy**. Defaults are:
 - HTTP listen: `0.0.0.0:8080`
 - HTTPS/TLS enabled: yes
 - HTTPS/TLS listen: `0.0.0.0:8181`
-- Admin listen: `127.0.0.1:9090`
+- Admin listen: `0.0.0.0:9090`
-- Allow remote admin: no
+- Allow remote admin: yes
 
-If you want the RustProxy administration UI reachable from another host, set the admin listener to an address such as `0.0.0.0:9090` and enable **Allow remote admin**. Apply restarts/reloads the service with the corresponding RustProxy CLI flags.
+The RustProxy administration UI is reachable from other hosts by default on port `9090`, subject to OPNsense firewall rules. Use **Open RustProxy Admin** after Apply to open the panel in a new browser tab. If `Admin listen` is `0.0.0.0:9090`, the button uses the hostname or IP address through which you opened OPNsense.
 
 Direct `pkg add` is supported: the package post-install script restarts OPNsense `configd`, flushes the plugin cache and renders `/usr/local/etc/rustproxy/opnsense.conf` so `configctl rustproxy status/start/stop` is available immediately.
 

opnsense-plugin/www/rustproxy/src/etc/rc.d/rustproxy

@@ -22,8 +22,8 @@ load_rc_config "$name"
 : ${rustproxy_proxy_listen:="0.0.0.0:8080"}
 : ${rustproxy_tls_enabled:="1"}
 : ${rustproxy_tls_listen:="0.0.0.0:8181"}
-: ${rustproxy_admin_listen:="127.0.0.1:9090"}
+: ${rustproxy_admin_listen:="0.0.0.0:9090"}
-: ${rustproxy_allow_remote_admin:="0"}
+: ${rustproxy_allow_remote_admin:="1"}
 
 enabled="0"
 config_file="/usr/local/etc/rustproxy/opnsense.conf"

opnsense-plugin/www/rustproxy/src/opnsense/mvc/app/controllers/OPNsense/RustProxy/forms/general.xml

@@ -42,12 +42,12 @@
         <id>rustproxy.general.adminListen</id>
         <label>Admin listen</label>
         <type>text</type>
-        <help>RustProxy administration listener passed as --admin-listen. Default: 127.0.0.1:9090.</help>
+        <help>RustProxy administration listener passed as --admin-listen. Default: 0.0.0.0:9090 so the panel can be reached from other hosts. OPNsense firewall rules still control who can connect.</help>
     </field>
     <field>
         <id>rustproxy.general.allowRemoteAdmin</id>
         <label>Allow remote admin</label>
         <type>checkbox</type>
-        <help>Required when Admin listen is not a loopback address, for example 0.0.0.0:9090. This passes --allow-remote-admin.</help>
+        <help>Pass --allow-remote-admin so the RustProxy panel accepts non-loopback clients. Keep firewall access restricted to trusted networks; do not expose the admin port to WAN unless this is intentional.</help>
     </field>
 </form>

opnsense-plugin/www/rustproxy/src/opnsense/mvc/app/models/OPNsense/RustProxy/RustProxy.xml

@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/rustproxy</mount>
-    <version>1.1.0</version>
+    <version>1.2.0</version>
     <description>RustProxy service settings</description>
     <items>
         <general>
@@ -23,12 +23,12 @@
                 <ValidationMessage>Enter a valid HTTPS/TLS listen address and port, for example 0.0.0.0:8181.</ValidationMessage>
             </tlsListen>
             <adminListen type="IPPortField">
-                <Default>127.0.0.1:9090</Default>
+                <Default>0.0.0.0:9090</Default>
                 <Required>Y</Required>
-                <ValidationMessage>Enter a valid administration listen address and port, for example 127.0.0.1:9090.</ValidationMessage>
+                <ValidationMessage>Enter a valid administration listen address and port, for example 0.0.0.0:9090.</ValidationMessage>
             </adminListen>
             <allowRemoteAdmin type="BooleanField">
-                <Default>0</Default>
+                <Default>1</Default>
                 <Required>Y</Required>
             </allowRemoteAdmin>
         </general>

opnsense-plugin/www/rustproxy/src/opnsense/mvc/app/views/OPNsense/RustProxy/index.volt

@@ -1,5 +1,79 @@
 <script type="text/javascript">
 $(document).ready(function() {
+    function parseAdminListen(value) {
+        value = (value || '').trim();
+        if (value.length === 0) {
+            return null;
+        }
+
+        // Bracketed IPv6, for example [2001:db8::1]:9090.
+        if (value.charAt(0) === '[') {
+            const end = value.indexOf(']');
+            if (end === -1 || value.charAt(end + 1) !== ':') {
+                return null;
+            }
+            return {
+                host: value.substring(1, end),
+                port: value.substring(end + 2)
+            };
+        }
+
+        const separator = value.lastIndexOf(':');
+        if (separator <= 0) {
+            return null;
+        }
+        return {
+            host: value.substring(0, separator),
+            port: value.substring(separator + 1)
+        };
+    }
+
+    function formatUrlHost(host) {
+        return host.indexOf(':') !== -1 ? '[' + host + ']' : host;
+    }
+
+    function openRustProxyAdmin() {
+        $.getJSON('/api/rustproxy/settings/get')
+            .done(function(data) {
+                const general = data && data.rustproxy && data.rustproxy.general
+                    ? data.rustproxy.general
+                    : {};
+                const listen = parseAdminListen(general.adminListen || '0.0.0.0:9090');
+                const remoteValue = general.allowRemoteAdmin;
+                const allowRemote = remoteValue === true || remoteValue === 1 ||
+                    ['1', 'true', 'yes', 'on'].indexOf(String(remoteValue || '').toLowerCase()) !== -1;
+
+                if (!listen || !listen.port) {
+                    BootstrapDialog.alert('{{ lang._("Invalid RustProxy admin listener configuration.") }}');
+                    return;
+                }
+
+                if (!allowRemote) {
+                    BootstrapDialog.alert('{{ lang._("Enable Allow remote admin and Apply the configuration before opening the RustProxy panel from another host.") }}');
+                    return;
+                }
+
+                let targetHost = listen.host;
+                if (targetHost === '0.0.0.0' || targetHost === '::' || targetHost === '*') {
+                    targetHost = window.location.hostname;
+                }
+
+                if (targetHost === '127.0.0.1' || targetHost === 'localhost' || targetHost === '::1') {
+                    BootstrapDialog.alert('{{ lang._("The RustProxy admin listener is bound to loopback only. Set Admin listen to an address reachable from your network, for example 0.0.0.0:9090, then Apply.") }}');
+                    return;
+                }
+
+                const url = 'http://' + formatUrlHost(targetHost) + ':' + listen.port + '/';
+                const adminWindow = window.open(url, '_blank');
+                if (adminWindow) {
+                    adminWindow.opener = null;
+                }
+            })
+            .fail(function() {
+                BootstrapDialog.alert('{{ lang._("Unable to read RustProxy settings.") }}');
+            });
+    }
+
     mapDataToFormUI({'frm_GeneralSettings': '/api/rustproxy/settings/get'}).done(function() {
         updateServiceControlUI('rustproxy');
     });
@@ -20,6 +94,10 @@ $(document).ready(function() {
             updateServiceControlUI('rustproxy');
         }
     });
+
+    $('#openAdminAct').click(function() {
+        openRustProxyAdmin();
+    });
 });
 </script>
 
@@ -37,7 +115,16 @@ $(document).ready(function() {
                     data-label="{{ lang._('Apply') }}"
                     data-error-title="{{ lang._('Error reconfiguring RustProxy') }}"
                     type="button"></button>
+            <button class="btn btn-default"
+                    id="openAdminAct"
+                    type="button">
+                <span class="fa fa-external-link"></span>
+                {{ lang._('Open RustProxy Admin') }}
+            </button>
             <br/><br/>
+            <p class="help-block">
+                {{ lang._('Remote administration is controlled by the RustProxy listener and OPNsense firewall rules. The plugin does not automatically create a WAN firewall rule for the admin port.') }}
+            </p>
         </div>
     </div>
 </section>

opnsense-plugin/www/rustproxy/src/opnsense/service/templates/OPNsense/RustProxy/rustproxy.conf

@@ -2,5 +2,5 @@ enabled="{% if not helpers.empty('OPNsense.rustproxy.general.enabled') %}1{% els
 rustproxy_proxy_listen="{% if not helpers.empty('OPNsense.rustproxy.general.proxyListen') %}{{ OPNsense.rustproxy.general.proxyListen }}{% else %}0.0.0.0:8080{% endif %}"
 rustproxy_tls_enabled="{% if not helpers.empty('OPNsense.rustproxy.general.tlsEnabled') %}1{% else %}0{% endif %}"
 rustproxy_tls_listen="{% if not helpers.empty('OPNsense.rustproxy.general.tlsListen') %}{{ OPNsense.rustproxy.general.tlsListen }}{% else %}0.0.0.0:8181{% endif %}"
-rustproxy_admin_listen="{% if not helpers.empty('OPNsense.rustproxy.general.adminListen') %}{{ OPNsense.rustproxy.general.adminListen }}{% else %}127.0.0.1:9090{% endif %}"
+rustproxy_admin_listen="{% if not helpers.empty('OPNsense.rustproxy.general.adminListen') %}{{ OPNsense.rustproxy.general.adminListen }}{% else %}0.0.0.0:9090{% endif %}"
 rustproxy_allow_remote_admin="{% if not helpers.empty('OPNsense.rustproxy.general.allowRemoteAdmin') %}1{% else %}0{% endif %}"