6. Access to the web interface, and getting back in

Who may open the page

By default anybody who can reach the server can open the login page (the login and two-factor authentication still apply). To limit it, open VPN server → Who may open this web interface:

Choice	Effect
Anybody who can reach the server	the default
Only these networks	for example your office; one network or address per line
Only people connected to the VPN	the safest: the page is not visible from the internet at all; open it through the VPN

The choice is enforced by the server's firewall, so it holds even if the web application has a flaw. Save, then press Apply and confirm like any other change.

Tunnelry will not save a choice that would lock out you: your own address must be inside the allowed networks, and for "only people connected to the VPN" you must be connected through it. The usual confirmation window adds a second net: if you cannot reach the page after applying, the change undoes itself.

The address of the web interface inside the tunnel is the server's VPN address, for example https://10.213.0.1:8443.

Lost access to the web interface

If a restriction locks you out anyway (for example you changed networks), open the server's console (SSH, or the console of the hosting provider) and run:

sudo /usr/lib/tunnelry/vpnctl gui_access.open

This opens the web interface to everybody again at once, and resets the application's own setting so the next Apply does not close it again. It works only on the console: the web application cannot call it.

Forgotten password or lost two-factor device

Password: ask another administrator who may manage users to set a temporary password for you (Accounts; you must change it at the next login). If nobody can, create a new administrator from the console:
```
sudo -u tunnelry php /opt/tunnelry/current/artisan admin:create --name="Jane Doe" --email=jane@example.com --permission=users.manage --permission=permissions.manage
```
Two-factor device lost: use one of the recovery codes saved when two-factor was set up. Without one, another administrator who may manage users can reset your two-factor authentication (Accounts → your account).

Lost the setup token

Run the installer again with --new-token (see installing). The token is only needed until the first administrator exists.

Next: uninstalling and troubleshooting.