# 6. Access to the web interface, and getting back in

## Who may open the page

By default anybody who can reach the server can open the login page (the login and two-factor authentication still
apply). To limit it, open **VPN server → Who may open this web interface**:

| Choice | Effect |
|---|---|
| Anybody who can reach the server | the default |
| Only these networks | for example your office; one network or address per line |
| Only people connected to the VPN | the safest: the page is not visible from the internet at all; open it through the VPN |

The choice is enforced by the server's firewall, so it holds even if the web application has a flaw. Save, then press
**Apply** and confirm like any other change.

Tunnelry will not save a choice that would lock out **you**: your own address must be inside the allowed networks,
and for "only people connected to the VPN" you must be connected through it. The usual confirmation window adds a
second net: if you cannot reach the page after applying, the change undoes itself.

The address of the web interface inside the tunnel is the server's VPN address, for example
`https://10.213.0.1:8443`.

## Lost access to the web interface

If a restriction locks you out anyway (for example you changed networks), open the server's console (SSH, or the
console of the hosting provider) and run:

```bash
sudo /usr/lib/tunnelry/vpnctl gui_access.open
```

This opens the web interface to everybody again at once, and resets the application's own setting so the next
**Apply** does not close it again. It works only on the console: the web application cannot call it.

## Forgotten password or lost two-factor device

- **Password:** ask another administrator who may manage users to set a temporary password for you (**Accounts**; you
  must change it at the next login). If nobody can, create a new administrator from the console:

  ```bash
  sudo -u tunnelry php /opt/tunnelry/current/artisan admin:create --name="Jane Doe" --email=jane@example.com --permission=users.manage --permission=permissions.manage
  ```

- **Two-factor device lost:** use one of the **recovery codes** saved when two-factor was set up. Without one, another
  administrator who may manage users can reset your two-factor authentication (**Accounts** → your account).

## Lost the setup token

Run the installer again with `--new-token` (see [installing](https://tunnelry.com/docs/install/index.md)). The token is only needed until the first
administrator exists.

Next: [uninstalling and troubleshooting](https://tunnelry.com/docs/uninstall-and-troubleshooting/index.md).