VLAN an Firewall rule not matching

johnpoz · Dec 13, 2021, 2:59 PM

@interessierter just saying that is why you have auto outbound listed. Any interface that can be used as wan (ie has a gateway) with auto outbound nat will be seen.

interessierter · Dec 13, 2021, 3:08 PM

@johnpoz But the seperate network (power beam) use 10.224.1.14/28, so it does not overlap with my networks 10.40.1.99/24.

Also the overlapping subnet is not only in the power beam NAT, it s also in the WAN source list. I still don t get why he list the IPs here.

So what is the solution? Disable the automatic Nating ?

johnpoz · Dec 13, 2021, 3:12 PM

@interessierter nobody said it overlapped?

edit: as to solution for what? You can have more than 1 wan, routing will just use normal routing via the default gateway or other routes you have setup, or policy routing via the firewall rules.

interessierter · Dec 13, 2021, 3:20 PM

@johnpoz I plan to have 4 different VLANS, and the first vlan should be a iot Vlan that only allow Internet access. Right now this nating route route to my "main" network so the separation does not make sense.

johnpoz · Dec 13, 2021, 3:24 PM

@interessierter you lost me..

Your traffic is not matching from the last you posted, the firewall rule shows 0/0

The other firewall entry you listed was firewall generating traffic.

If you say you can get to this IP from another vlan.. It wouldn't have anything to do with outbound nat, port forwards could be.. But I don't see any portforwards on your lan that would match that traffic.

If your saying your client can get to that IP, maybe its taking a different path... Maybe its on the same L2 and you have the client with the wrong mask?

interessierter · Dec 13, 2021, 3:45 PM

@johnpoz Yes maybe I m lost.

The main network is 192.168.1.0/24, the VLAN 10.40.23.99/24

The Client (mobile phone) is connected with a Access Point, the SSID is tagged with 4000, the switch have a configuration as hybrid port, and the tags 1000,2000,3000,4000,1 is configured. Than the switch connect to pfsense with the same config.

As I can see the allow of the connection from the 10.40.23/24 network to 192.168.1.0/24 in the pfsense log I guess, that the routing must be happening here and not before.

Here a post again of my port forwardings, that also does not contain any network that is in question here:

login-to-view

johnpoz · Dec 13, 2021, 3:49 PM

@interessierter said in VLAN an Firewall rule not matching:

As I can see the allow of the connection from the 10.40.23/24 network to 192.168.1.0/24 in the pfsense log I guess

where?

Here?

login-to-view

The allowed there is because the traffic was generated by pfsense.. There are rules that let the firewall go where it wants..

[21.05.2-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep "let out"
pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"

interessierter · Dec 13, 2021, 5:14 PM

@johnpoz Yes but to be honest I don t know what rule that should be? How does such a rule look like?

johnpoz · Dec 13, 2021, 5:19 PM

@interessierter I just showed you what the rule looks like ;)

Its a hidden rule.

You can view all the rules via
https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

There are a few hidden rules, mostly to keep users from shooting themselves in the foot ;) Common example of these is when you enable dhcp server on an interface, rules are created (hidden) that make sure dhcp will work.

notice those rules are pass "out" rules, which is why you see the little black triangle on the firewall entry.

What I would look into is why your rule is not triggering? Do you still show 0/0 for the states on your block 192_netz rule? You could look in your tables under the diagnotic menu to make sure that table is showing your 192.168.1/24 network.

Possible your rules have not be loaded?

interessierter · Dec 13, 2021, 5:56 PM

@johnpoz My rules are definitly saved and loaded, the tables show this:

login-to-view

Yes it s still zero

johnpoz · Dec 13, 2021, 6:21 PM

@interessierter that is not the 192_netz table..

Also why are you natting a 172.168.1.0? that is a typo? without a mask?

See here is my rfc1918 alias table I created entries

login-to-view

interessierter · Dec 13, 2021, 6:28 PM

@johnpoz I dont know but I guess it will not solve the issue right?

I have for my main network right now 192.168.1.0/24
vlan 10.10.23.99/24
vlan2 10.20.23.99/24
vlan3 10.30.23.99/24
vlan4 10.40.23.99/24
vlan5 10.45.23.99/24

My 192 Netz only contains 192.168.1.0/24, because I want to block requests to this network

johnpoz · Dec 13, 2021, 6:29 PM

@interessierter I get that.. But your not showing that the table actually loaded.

And your rule is not triggering from the 0/0 in the states column.. Why its not is the question.. Maybe the table didn't load? Maybe your client isn't going through pfsense?

I don't see any other rules above it that would allow the traffic..

interessierter · Dec 13, 2021, 6:32 PM

@johnpoz What table you want to see?

johnpoz · Dec 13, 2021, 6:34 PM

@interessierter

The table alias you created the 192_netz table.

What version of pfsense are you running exactly? There was some issues in the dev versions the other day where state tables not counting.. and all showing 0/0

Alias tables normally do not populate until used in a rule.. But lets make sure the alias you created actually created the table and put in the 192.168.1.0/24 network.

interessierter · Dec 13, 2021, 6:37 PM

@johnpoz login-to-view

login-to-view

johnpoz · Dec 13, 2021, 6:49 PM

@interessierter dude that is not the actual TABLE that is created from the alias..

Go to the diagnostic menu, pick tables then select your 192_netz table.. Does it list this network, do you see the table in the table drop down?

See my above example showing my rfc1918 table created from my rfc1918 alias.

What I am trying to verify is this

login-to-view

interessierter · Dec 17, 2021, 1:25 PM

@johnpoz said in VLAN an Firewall rule not matching:

@interessierter dude that is not the actual TABLE that is created from the alias..

Go to the diagnostic menu, pick tables then select your 192_netz table.. Does it list this network, do you see the table in the table drop down?

See my above example showing my rfc1918 table created from my rfc1918 alias.

What I am trying to verify is this

login-to-view

Sorry do you mean here? If yes, the 192_Netz is not here:
login-to-view

johnpoz · Dec 17, 2021, 1:29 PM

@interessierter well if you do not see your table populated, then that would explain why that rule is not working.

As I highlighted, tables that you create with an alias are not populated until they are put into a rule, and the rule is loaded.

If your not seeing the table listed under diagnostics. Then no it wouldn't work..

interessierter · Dec 17, 2021, 1:32 PM

@johnpoz said in VLAN an Firewall rule not matching:

@interessierter well if you do not see your table populated, then that would explain why that rule is not working.

As I highlighted, tables that you create with an alias are not populated until they are put into a rule, and the rule is loaded.

If your not seeing the table listed under diagnostics. Then no it wouldn't work..

But what did I wrong? I have saved and applied the rule after creating, and I m sure that the firewall was also rebooted in the time between (what should be anyway not required).