VLAN an Firewall rule not matching

interessierter · Dec 9, 2021, 8:00 AM

Hello folks!

Yesterday I tested to use a seperate VLAN for a wifi SSD. I have configured the VLAN Tags on the AP, on the interface of pfsense, and activated a seperate DHCP for it. All fine so far.

The only problem is, that Internet is in the vlan not working. The reason is, that pfsense block all requests with the default rule. I have created firewall rules for DNS, 443 and 80 for testing on the vlan rule tab on the firewall. However the rules are simply not matching.

Any ideas what is wrong here?
greetings

johnpoz · Dec 9, 2021, 8:02 AM

@interessierter where did you set these rules, when you create a new interface vlan or native no rules are created.

Posting of your rules and what your seeing in the firewall log as blocked would be helpful in helping you figure out what is not right.

interessierter · Dec 9, 2021, 8:17 AM

@johnpoz I have now under Firewall Rules a seperate Tab for the VLAN. On this VLAN I have created this rules with hand

johnpoz · Dec 9, 2021, 4:24 PM

@interessierter and if you do not show us them, how do we know if they are right?

Clearly they are not correct if you say you allow X on vlan Y, and your showing a block on vlan Y interface as blocked.

Maybe you allowed only tcp and what is being blocked is udp, maybe what your seeing in the blocks is out of state traffic ?

Without actually seeing the rules and what is being blocked..

interessierter · Dec 9, 2021, 4:24 PM

@johnpoz login-to-view

johnpoz · Dec 9, 2021, 4:29 PM

@interessierter couple of things.. Wan net is NOT the internet, its just the Wan net.. So no that is not going to allow for internet.

Since you put in your test rule that is any any - are you seeing blocks?

Also vs ANY for the source, the any should be set to the "net" of that vlan.. Unless you had downstream networks, and this vlan was transit, should limit the source to the net interface is connected to.

I don't see any hits on any of those rules either they are all 0/0 - so is your client even talking to pfsense? On this vlan interface?

interessierter · Dec 10, 2021, 8:17 AM

@johnpoz said in VLAN an Firewall rule not matching:

@interessierter couple of things.. Wan net is NOT the internet, its just the Wan net.. So no that is not going to allow for internet.

Since you put in your test rule that is any any - are you seeing blocks?

Also vs ANY for the source, the any should be set to the "net" of that vlan.. Unless you had downstream networks, and this vlan was transit, should limit the source to the net interface is connected to.

I don't see any hits on any of those rules either they are all 0/0 - so is your client even talking to pfsense? On this vlan interface?

I have tried as source everything, that was the last. There is also no change when I set it to the IP address or subnet as source.
Tried to put ANY ANY, does not change the situation

I have on the firewall rules 3 tabs, the first one is the main without any VLANS. The screenshot only show the VLAN where my client is in. And yes, this network contains clients that are also working. It feels like that the main rules are blocking this.

johnpoz · Dec 10, 2021, 10:00 AM

@interessierter said in VLAN an Firewall rule not matching:

It feels like that the main rules are blocking this.

The lan rules have ZERO to do with what a vlan can do..

Let see these blocks your seeing..

interessierter · Dec 10, 2021, 11:52 AM

@johnpoz I know that there should no relation. But when I have a ANY ANY Rule, and still the log tells me the default rule block the request, than it must be something else

interessierter · Dec 10, 2021, 1:34 PM

@interessierter Hm after a restart of pfnblocker it works

johnpoz · Dec 10, 2021, 1:34 PM

@interessierter Please show us the blocks... And your rules - I want to see if there is any triggers 0/0 like you showed that none of those rules have matched.

interessierter · Dec 11, 2021, 5:37 PM

@johnpoz its solved, its working after a reboot of pfnblocker

interessierter · Dec 12, 2021, 1:57 PM

@interessierter said in VLAN an Firewall rule not matching:

@interessierter Hm after a restart of pfnblocker it works

The Part of DHCP is working now.
I got a xaomi vacuum cleaner, and this device needs WLAN to work fully. However I want to seperate this device from the rest of my network, but I strugle here.

I have created vlans, a seperate WLAN SSID, and tag this SSID of VLAN ID 4000. This is configured on the switch between, the AP and the pfsense. But right now all other devices are NOT tagged with vlans, I have to do that step by step. However I want to start with the new xaomi device.

What I want to do is, to allow on the VLAN 4000 only Internet access, but DENY all access to my existing network infrastructure. I have tried several DENY rules on pfsense, but the access is still possible.

How should such a rule look like to work?
thanks

johnpoz · Dec 12, 2021, 1:57 PM

@interessierter here is a typical common configuration for a locked down vlan

login-to-view

Create an alias that contains all the rfc1918 space, this way as you add more vlans you don't have to worry that they would not be blocked.

login-to-view

Certain services are normally required like dns, etc.. But if the device points to outside for dns, you could remove that, same with ntp, and if you don't want it to ping its gateway.

But this is a very limited vlan setup. It can not talk to anything on local networks, only internet

interessierter · Dec 12, 2021, 5:02 PM

@johnpoz I have a Alias with 192.168.1.0/24 and this Firewall rule to block:

login-to-view

But the browser access to 192.168.1.30 is still possible. The Test Client is in 10.40.23.99 net.

johnpoz · Dec 12, 2021, 5:14 PM

@interessierter did you clear states after you created a block rule?

States are evaluated before rules, so if there was an existing state, that state would allow it before your rules are even looked at.

I don't see any triggers on that rule.. It shows 0/0 for states - so it was never evaluated.

Do you have any rules in floating that would allow the traffic?

interessierter · Dec 12, 2021, 5:23 PM

@johnpoz I have found this in the logs. It seems like all traffic will be blocked, only the connection to 192.168.1.30 is working. Why is that threaded differently?

login-to-view

interessierter · Dec 12, 2021, 5:26 PM

@interessierter the other rules on this vlan. No floating rules

login-to-view

johnpoz · Dec 12, 2021, 6:02 PM

@interessierter well your rule is not triggering, again you have a 0/0 for states..

You created your alias wrong maybe..

Rules are evaluated top down, first rule to trigger wins.. no other rules are evaluated. If default deny rule is being trigger then non of your rules above it either block or allowed were triggered.

As to that lan rule anything from the firewall itself are you natting this vlan for some reason?

interessierter · Dec 13, 2021, 8:00 AM

@johnpoz The Alias is correct:

login-to-view

OK the Block rule was not on the first position, but it does not make any difference. Access is still possible.

What I found is here some old NAT rules from a TEST for VPN:
login-to-view