Unblocking WebUI Access

Networking Solutions Hotline & FAQ
1

If you can no longer reach your device’s WebUI due to too many incorrect password attempts, you can restore access using one of the methods described below.

  • Reset the device to factory settings. A reset restores all configurations to their out-of-the-box state and in the process clears the list of blocked users. You can find more on how to perform a reset to factory settings in your device’s Device Recovery Options page.

  • Connect from a different IP address. For example, connect a new device via LAN, WiFi or change the IP address of your current device manually then navigate to the System → Administration → Access Control → Security]] page, scroll down and delete the blocked IP address entry.

2

Hello @Marija,

My silly oversight after having changed passwords so many devices already few days earlier got me accidentally blocked out today and I finding how to undo blocking.

While clearing that blocked IP I came across following:

  1. RUTX_R_00.07.24.5 there under location: System → Administration → Access Control
    There isn’t a “Safety” but what you possibly meant “Security” tab available.

  2. This software version did not show up my blocked adresss at all. Under “Security” tab there was nothing under “Login attempts”, it showed “0 selected” and “This section contains no values yet”.

To unblock something that was blocked but not visible I had to use “Clean after reboot” under “Settings” and reboot to get blocked cleared.

It would be great to be able to clear web admin blocked addresses also directly root login shell command line without needing a rebooting device.

I would find it really so much quicker via ssh-key authorized root session to issue just a single command to get it done without rebooting device.

If there is a command line tool that can do it, please let us know it also.

:slight_smile: riku

ps. Just to add and let you know if it matters that 2. blocked host was not directly connected admin blocking RUTX subnet, but further away behind another (management lan) subnet behind another firewall. But if no-show fault was about that, then I’d expect it would have shown that firewall IP showing, but it wasn’t. Nor was it blocking that another laptop I did use to set that Setup clearing option during boot sequence. So the blocked laptop and non-blocked were both same subnet, not directly RUTX connected subnet, but behind firewall which had IP in that RUTX directly connected subnet.

4

Greetings,

Thank you for pointing out the incorrect tab name. It is Security, not Safety. I have updated the initial post.

By default, an IP address is blocked for 10 minutes after 10 unsuccessful login attempts. Once this period expires, the block is automatically lifted and the entry is removed from the list, which could explain why it was empty when you checked.

If needed, you can also select Permanent blocking under System → Administration → Access Control → Security → Settings.

You can also unblock an address through a root SSH session without rebooting the device. First, display the recorded login attempts:

ubus call ip_block show

Then unblock the relevant entry using the following command, replacing the placeholders with the exact IP address and port value shown in the output:

ubus call ip_block unblock '{"ip":"<blocked_ip_address>","port":"<port_from_output>"}'

Best regards,
T.

5

Hello,

OK, so with ubus there’s a way to do it when it shows blocked IP addresses. Good to know, thanks.

Those other clearing options, including permanent blocking under Settings are OK and were not hard me to find.

But I still think you still did not get my previous post completely. My explanation was not perhaps good enough. So one more try, just for sake of completeness.

  • Once I got logged in “admin” account from another laptop next to me and found tat place from WebUI from where I was supposed to unblock blocked laptop IP. There was nothing to unblock. I did not see anything was blocked. Therefore there was no way me able to unblock it using WebUI.

  • I got it resolved finally turning on “Clean after reboot” and rebooted. But before I got that far, I did try many other commonly known & used means to solve this kind of WebUI issues.

  • So before falling back to reboot fixes it, I cleared cookies and restarted blocked laptop browser couple times but that didn’t work either. I tried from same laptop different browsers, which one I had never even logged in this router. But the other laptop had no issues logging me in “admin” user. All these browsers are commonly used up to date updated last available versions. And none had any browser addons (plugins) active while testing which could have caused issues.

Summary:

  • Both these laptops are using one same (management lan) a subnet which is physically behind a completely separate firewall device. That firewalls another interface towards RUTX50 is directly connected RUTX50 inside subnet and where WebUI access is allowed.

  • So that the laptops were not directly connected LAN and RUTX50 saw both coming from single that other firewall IP address.

  • One of them laptops was not able to login “admin” and the other was.

  • There was nothing showing under that System → Administration → Access Control → Security to unblock.

  • Only way I was able to solve was with reboot.

Thinking more about the cause and how to perhaps resolve same in future

It now appears to me that most likely reason for blocking this case was not to do with IP addresses at all, but it most likely was a WebUI & rpcd session with that client (laptop) getting screwed.

Because laptops were connected via another firewall which most likely mapped same local socket (port+ip) from each laptop towards RUTX50 it did not matter when I cleared laptop cookies, cache, restarted browser and tried multiple browsers. RUTX50 saw them coming towards HTTPS port from same socket which then had some trouble.

But if you have better theories, let me know.

Anyway, the “ubus -v list” reveals also other arguments (See below) which might be worth studying bit more, so I did :slight_smile:

‘ip_block’ @cbb6f549
“show”:{“type”:“String”,“blocked”:“Boolean”}
“push”:{“ip”:“String”,“destination_ip”:“String”,“port”:“String”,“proto”:“String”}
“unblock”:{“ip”:“String”,“destination_ip”:“String”,“port”:“String”}
“reload”:{}
“clear”:{}
“push_phone”:{“phone”:“String”}
“unblock_phone”:{“phone”:“String”}
“push_mac”:{“mac”:“String”,“interface”:“Array”}
“unblock_mac”:{“mac”:“String”,“interface”:“Array”}
“rebooted”:{}

There is only very brief wiki page[1] with not much help if another device or not being able to change IP address either. Which well happen with a company managed device where you don’t have admin rights or root access.

  1. Unblocking WebUI Access - Teltonika Networks Wiki

So a I decided to do short chat with Google AI, which gave me following explanation of those values.

If that is correct, valid information and gets approved by your R&D, how about adding this or at least some parts of that information to your wiki page?

---- cut ----

Teltonika ip_block ubus methods and arguments explained

The ip_block service is a proprietary Teltonika Networks security component (part of the RutOS brute-force prevention system). Below is a breakdown of the available methods and their expected JSON arguments based on the ubus -v list output.

Method Description and Purpose
reload Reloads the configuration from /etc/config/ip_block. Use this after modifying configuration parameters (such as lease times or retry counts) via UCI to apply changes without restarting the firewall or the device.
clear Clears all dynamic IP blocks from memory instantly. Useful if multiple legitimate clients are locked out or for resetting the service state during troubleshooting.
push Manually injects a dynamic firewall block based on specified criteria (ip, destination_ip, port, proto). Used to drop traffic from a specific source attempting to access a particular destination port/protocol.
unblock Manually removes a dynamic block that was created either automatically by the system or via the push method for a specific IP, destination IP, and port.
push_phone Used for SMS-based brute-force prevention (e.g., Modbus SMS gateway or SMS management). Temporarily blacklists a specific phone number (phone) after excessive unauthorized or failed interactions.
unblock_phone Removes the specified phone number from the dynamic SMS blocklist.
push_mac Blocks a device at the link layer (L2) based on its MAC address (mac) within specific network interfaces (interface, e.g., ["lan"]). This completely cuts off the device’s access to the router and the local network segment.
unblock_mac Removes the link-layer block for the specified MAC address on the selected interfaces.
rebooted An internal signal method called by the system (e.g., via procd init) during bootup. It triggers the initialization sequence and handles state persistence routines, such as purging the dynamic lists if the “Clean after reboot” option is enabled.

CLI Usage Examples:

# Clear all dynamic blocks immediately
ubus call ip_block clear

# Manually block an IP for SSH (port 22) over TCP
ubus call ip_block push '{"ip":"192.168.1.50", "destination_ip":"192.168.1.1", "port":"22", "proto":"tcp"}'

# Manually block a device by MAC address on the LAN interface
ubus call ip_block push_mac '{"mac":"AA:BB:CC:DD:EE:FF", "interface":["lan"]}'

— cut —

And from which we can at least test if unblocking works without reboot, next time same happens again.

# 1. Clearing Teltonika router dynamic brute-force-blocking memory
ubus call ip_block clear

# 2. Restarting rpcd (this clears session WebUI tokens from memory)
/etc/init.d/rpcd restart

# 3. Reopen new session with browser trying login again

I wrote this reply mostly for your information that there might be something with the WebUI & rpcd logic blocking may happen later that your other users report seeing similar thing and if that ubus clearing an IP does not work.

Cheers,

:slight_smile: riku