Firewalling

• S

  Firewall blocks RDP connection
  • Schalex

  12
  0
  Votes
  12
  Posts
  84
  Views

  

  Hummm. This was a puzzle in a puzzle. Didn't understand the answer of@Konstanti . Then I focused on "120000", a rule number that exist for all of us, under 'special' conditions'. @schalex said in Firewall blocks RDP connection: When i go on the Red X i get the message "block/12000". @Schalex : asking the WAN to block local IP addresses (192.168.1.x and family) if you have a router (the ISP router) in front a a router (pfSense) that will kill (99.9999999 %) of all incoming NAT connections (because they will be 'local'). @Konstanti
• C

  Firewall/Routing Between Connected VLANs
  • cursor

  6
  0
  Votes
  6
  Posts
  1345
  Views

  S

  I found this thread today while I also try to get my fw rules right for allowing traffic between VLANs. What puzzles me is that I don't see any blocked packages in the system logs, so the theory that they are routed somewhere else sounds valid ;-) Could someone pls be more specific? Do I need a PASS-rule on every VLAN-interface tab for bypassing?
• ?

  Confused over rules
  • Guest

  13
  0
  Votes
  13
  Posts
  154
  Views

  

  You are correct though there are cases were the source IP would be different than the net the interface is connected to.. If this was the case any could be used as source, or restrictive cidr containing all your possible downstream... But there would never be a case where lan 2 was seen on lan 1 as source... Unless you had a LOOP and crossover between your L2 networks.. Which would be BAD! ;) He was putting in his other networks as source.. Which would never be the case.
• M

  PFsense virtualized by proxmox: GW2 blocked
  • megs

  1
  0
  Votes
  1
  Posts
  20
  Views

  No one has replied

• B

  Webserver behind pfSense on port80 - Port closed
  • bumzag

  2
  0
  Votes
  2
  Posts
  32
  Views

  B

  Nevermind, the issue was my own stupidity. I enabled some random unrelated rule that had port 80 listed in the port column in Windows Firewall. All I had to do was add a custom rule on port 80 and allow traffic. Everything works. This can be closed.
• U

  Advice needed - way to give rule descriptions to syslog server
  • user2

  1
  0
  Votes
  1
  Posts
  24
  Views

  No one has replied

• H

  [Solved] Unable to access one of two VLANs from outside
  • helgew

  8
  0
  Votes
  8
  Posts
  111
  Views

  B

  @helgew said in [Solved] Unable to access one of two VLANs from outside: @brians I didn't post those because they are a bit more complex. I was doing all the trouble shooting from a WLAN client. That said, I nuked the IPCAMS VLAN and interface, re-added both as well as the DHCP server and now everything works. Good that you got it working.
• J

  Java downloads not getting through despite Allow All rule
  • jenningsb

  4
  0
  Votes
  4
  Posts
  125
  Views

  

  @jenningsb said in Java downloads not getting through despite Allow All rule: We have some software that tries to download a Java package every time it is opened. If I disable the firewall completely, the download works fine. If the firewall is enabled, the download fails. I've tested by creating an Allow All rule on the Lan interface and disabling all other outbound rules with no success. I've disabled all add-on packages (squid, snort, etc) with no success. The only thing that works is to disable the firewall in System\Advanced\Firewall. This is a very simple setup. Single LAN interface and single WAN interface. When you disabled Snort, did you go in to the BLOCKED tab and flush all the blocked IP addresses? Simply turning off Snort will not remove any previously Snort blocked IP addresses.
• P

  Wifi router behind pfsense appliance - bypass risk?
  • pastic

  8
  0
  Votes
  8
  Posts
  126
  Views

  A

  @jknott said in Wifi router behind pfsense appliance - bypass risk?: @akuma1x said in Wifi router behind pfsense appliance - bypass risk?: Give it NO access to your network(s), and only let it talk out to the internet. That would be appropriate if he wants a guess WiFi, but I didn't see that mentioned. If he wants to access his network via WiFi, as is often done in homes and businesses, then that's not a such a good idea. True, he didn't say one way or the other how he wanted to do it. Here's one: guest network with a good WPA2 passcode, like above. Limit, or give it no access, to your main LAN network. Here's the other: on and part of your main LAN network. Use a good WPA2 passcode, maybe make the SSID hidden (but it can be found by anybody with basic wifi tools), make sure it's firmware stays up-to-date to plug up any security holes. Remember, you're dealing with consumer gear, the manufacturer tends to not update firmware for too long, they want to sell more, newer, better wifi gear. It's just going to be a simple access point, so you won't get much, if any, in the way of firewalling or routing. Is getting newer wifi gear out of the question? I ask, because most, if not all, of the newer access point things offer VLAN capabilities. That means, with 1 wifi box, you can offer up multiple wifi networks, guest and main LAN, as an example. Add a simple 5-8 port managed switch to the mix to move this traffic in the right directions, and you can be done. This gives you 2 wifi signals, 1 that can be isolated to just the internet, the other that sits on your main LAN. Jeff
• L

  'Default deny rule IPv4 (1000000103)' WAN Drops - Help/Explanation needed
  • lpacor

  4
  0
  Votes
  4
  Posts
  62
  Views

  

  @lpacor IGMP:- https://en.wikipedia.org/wiki/Internet_Group_Management_Protocol NetBIOS:- https://en.wikipedia.org/wiki/NetBIOS
• Y

  Default deny rule IPv6 (1000000105) - Internet Drops
  • yupq6wlc79ts

  2
  0
  Votes
  2
  Posts
  75
  Views

  Y

  Anyone that can help please? :(
• E

  Multicast video stream not being blocked despite deny rule
  • exico

  9
  0
  Votes
  9
  Posts
  108
  Views

  

  Thanks for the clarification jknott, I was trying to keep it simple in terms of multicast should normally not be routed out the wan, etc. And it shouldn't be since it wouldn't actually be sent to the gateway. Router doesn't just take a multicast packet and say, hey I should send this out my wan to help get where its going.. If so then all the nonsense multicast SSDP traffic windows clients send would get sent out the wan, etc.
• R

  [Solved] Why do I see ssh warnings for traffic that should be firewalled?
  • ryanjaeb

  3
  0
  Votes
  3
  Posts
  84
  Views

  R

  @KOM No, but, after comparing it to similar configs, I tracked it down to a floating firewall rule (used for traffic shaping) that had a Pass action instead of a Match action.
• D

  Access to WebGUI from WAN
  • DazzaBear

  3
  0
  Votes
  3
  Posts
  61
  Views

  D

  You are a genius :) Thanks very much, tried it and viola, first time :)
• P

  Firewall "Pass" rules are not processing non-SYN tcp packets
  • pfuser23409

  2
  0
  Votes
  2
  Posts
  54
  Views

  

  Why would you want/need to pass traffic that is out of state? That screams asymmetrical traffic flow that should be avoided not allowed. If you need/want to allow for asymmetrical, etc.. See that section in the docs https://www.netgate.com/docs/pfsense/firewall/troubleshooting-blocked-log-entries-due-to-asymmetric-routing.html They suggest a few work arounds... But would really think to why you would want to allow non state traffic through your firewall.
• M

  Alias Not Working But Single IP's Do
  • mbc0

  2
  0
  Votes
  2
  Posts
  68
  Views

  V

  The alias should be applied to each included IP in the same way. However, consider that already existing connections (existing states) are not closed when the scheduled block rule gets active. You can set up a scheduled pass rule (you will have to adjust the schedule time) followed by a static block rule to achieve this.
• J

  Aliases FQDN + IP addresses
  • jgrimm

  4
  0
  Votes
  4
  Posts
  102
  Views

  J

  I checked the tables and there were some (empty) old entries, I took the opportunity to update and reboot. The ip addresses on mixed fqdn/ip aliases look fine and the empty tables are gone. Perhaps I typed something wrong. Anyhow, I forgot about the tables tool, thanks johnpoz
• S

  Zombie State: Curtailing Rouge Servers [Outbound Rules]
  • sisterpfsense

  2
  0
  Votes
  2
  Posts
  92
  Views

  

  If you don't trust your own LAN, what do you trust? If you want to block everything on your LAN from Internet access then do that via firewall rules or web proxy. Besides, you will find that malicious traffic will happily use tcp80,443 to talk because: The bad traffic will get mixed into all the other http/s traffic and be harder to detect. Standard ports are likely to be blocked off while tcp80,443 are almost always available.
• J

  LAN connection 192.168.1.1 to Webconfigurator
  • jensen4230

  5
  0
  Votes
  5
  Posts
  107
  Views

  J

  Ok, Thankyou - I'll try.
• M

  firewall Schedule set for all weekdays possible?
  • mbc0

  1
  0
  Votes
  1
  Posts
  48
  Views

  No one has replied

• I

  Transparent firewall with multiple subnets asymmetric routing issue
  • idagroup

  1
  0
  Votes
  1
  Posts
  62
  Views

  No one has replied

• M

  Block DNS over HTTPS from clients on LAN
  • marian78

  3
  0
  Votes
  3
  Posts
  91
  Views

  M

  thx for quick reply. So, for now we dont have any solution to solve this on pfsense box?
• D

  Advice to isolate few known hosts on the same network
  • d82k

  4
  0
  Votes
  4
  Posts
  117
  Views

  

  @d82k said in Advice to isolate few known hosts on the same network: would it be feasible? Unless the traffic actually passes through pfSense, no. If they're all on the same subnet, the traffic will never pass through pfSense, so it can't have any effect.
• E

  Firewall Advice
  firewall security • • eddiemcdiarmid

  4
  0
  Votes
  4
  Posts
  144
  Views

  A

  @eddiemcdiarmid said in Firewall Advice: Hmm interesting. I don’t have any rules but the managed of the network I’ve named ‘external network’ can see my router. Is there a rule I can add to block them being able to access my network? Seeing your network and accessing your network are two very different things. You say both in your reply post above. The default block/deny rules on every pfsense install for the WAN interface, like @johnpoz talks about above, keeps people/hosts from accessing your network. You don't need to do it, but if you're really paranoid about that external network, you could set a specific block rule in your WAN interface to block/deny it's IP addresses. Again, you really don't need to do it, however. This is an example of the default settings and wording from an old version of pfsense, but I think the current versions still look like this on the WAN interface: Jeff
• H

  Possible to generate log when specific host reaches max state set in rule?
  • hopkins

  2
  0
  Votes
  2
  Posts
  79
  Views

  H

  Anyone have ideas?
• V

  This topic is deleted!
  • vatread

  2
  0
  Votes
  2
  Posts
  6
  Views
• K

  VPN Kill Switch Blocks Website Access
  • kiekar

  2
  0
  Votes
  2
  Posts
  86
  Views

  K

  @kiekar Resolved issue by adding new floating out rule above kill switch.
• K

  Major security flaw! : Invert Match rules not working as intended with DNSBL enabled
  • keyser

  10
  0
  Votes
  10
  Posts
  168
  Views

  

  It would require a change upstream in pf. Proper firewall rule design should be adhered to. I probably can't convince you on this, but my stance and point remains :-) Right, which is why I created 6799.
• L

  IPVanish VPN client works, internal network doesn't.
  • lpiatt

  1
  0
  Votes
  1
  Posts
  37
  Views

  No one has replied

• G

  Modem GUI/SSH access stops when pfsence has active PPPOE connection.
  • girtsj

  32
  0
  Votes
  32
  Posts
  290
  Views

  

  @girtsj Its the way that particular modem was designed. Ive got one I ran for a couple of weeks before going to bonded service at one of our shops. It was the only way I could make it work.. going from memory. @netblues Since the PPPoe session creates a pipe through the interface anything outside the pipe on the WAN is unreachable from the router without some configuration to make it work such as what is described on the "accessing modem" page linked earlier. If a store bought router works out of the box I have to believe that the manufacturer has built something into that particular router allowing the connection. It would be like creating a leak somehow. I could never make our Huawei work using the information from the modem access page either. But it did work with the ZOOM 15 series modems we were using.
• A

  Printer (and possibly other things) being blocked by firewall with allow any rule
  • andrewhancock91

  9
  0
  Votes
  9
  Posts
  179
  Views

  A

  I wanted to post an update for anyone else that may have a similar issue and stumble across this. My plan for the windows static routes did not work at all, it looked like it did at first but within a couple hours print jobs were hanging again. I ended up having an opportunity over the long Christmas weekend to get into the 3rd party Cisco devices and configure a transport network which (knock on wood) seems to have eliminated the issue. The firewall is up and I've been checking the print logs several times a day and have yet to see any errors or hung jobs so I does indeed look like asymmetric routing was the issue. Thanks @johnpoz for the help!
• Y

  pFsense : Firewall static routes ?
  • yboujraf

  1
  0
  Votes
  1
  Posts
  61
  Views

  No one has replied

• S

  pfSense firewall connecting to Verizon FIOS Quantum Router Setup
  • Smack2k

  1
  0
  Votes
  1
  Posts
  45
  Views

  No one has replied

• S

  Missing Ipsec tab for firewall rules
  • snoopy99

  2
  0
  Votes
  2
  Posts
  55
  Views

  

  You need to create and apply Phase 1 first to get the IPsec tab in Firewall Rules. -Rico
• A

  WAN > Default deny rule IPv4 (1000000103)
  • Allan123456

  1
  0
  Votes
  1
  Posts
  75
  Views

  No one has replied

• P

  error(s) loading the rules after upgrade to 2.4.4-1
  • pranav

  20
  0
  Votes
  20
  Posts
  287
  Views

  

  Yep, that did it. Issue here: https://redmine.pfsense.org/issues/9231 Fix pushed, will show up on Redmine shortly.
• Е

  pfsense blocks everything in lan
  • Евгений

  16
  0
  Votes
  16
  Posts
  220
  Views

  Е

  gods pfsense save me ))
• Y

  Firewall Rules not working
  • yupq6wlc79ts

  22
  0
  Votes
  22
  Posts
  211
  Views

  K

  @yupq6wlc79ts It is possible to allocate them in a separate subnet ( as I have done) or create an alias firewall / alias ( write there all 5 ip) and then use the alias in the rule as a source. Then the rule will be one
• E

  Block Incoming connections
  • eddiemcdiarmid

  5
  0
  Votes
  5
  Posts
  150
  Views

  

  And what are you rules on your wan links... By default they would be no rules and everything would be blocked... Only if you put rules on these wan interfaces could stuff be allowed in.. So post up you rules..
• O

  Firewall gets into bad state - cannot establish connections
  • opoplawski

  5
  0
  Votes
  5
  Posts
  111
  Views

  O

  How can I keep the "pfctl -x loud" setting active?