Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN an Firewall rule not matching

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    68 Posts 3 Posters 13.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @interessierter
      last edited by johnpoz

      @interessierter said in VLAN an Firewall rule not matching:

      As I can see the allow of the connection from the 10.40.23/24 network to 192.168.1.0/24 in the pfsense log I guess

      where?

      Here?

      hits.jpg

      The allowed there is because the traffic was generated by pfsense.. There are rules that let the firewall go where it wants..

      [21.05.2-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep "let out"
      pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
      pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"
      

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      I 1 Reply Last reply Reply Quote 0
      • I
        interessierter @johnpoz
        last edited by

        @johnpoz Yes but to be honest I don t know what rule that should be? How does such a rule look like?

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @interessierter
          last edited by johnpoz

          @interessierter I just showed you what the rule looks like ;)

          Its a hidden rule.

          You can view all the rules via
          https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

          There are a few hidden rules, mostly to keep users from shooting themselves in the foot ;) Common example of these is when you enable dhcp server on an interface, rules are created (hidden) that make sure dhcp will work.

          notice those rules are pass "out" rules, which is why you see the little black triangle on the firewall entry.

          What I would look into is why your rule is not triggering? Do you still show 0/0 for the states on your block 192_netz rule? You could look in your tables under the diagnotic menu to make sure that table is showing your 192.168.1/24 network.

          Possible your rules have not be loaded?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          I 1 Reply Last reply Reply Quote 0
          • I
            interessierter @johnpoz
            last edited by

            @johnpoz My rules are definitly saved and loaded, the tables show this:

            daf36c8f-70cf-42ce-9988-cfcc659fe35e-image.png

            Yes it s still zero

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @interessierter
              last edited by johnpoz

              @interessierter that is not the 192_netz table..

              Also why are you natting a 172.168.1.0? that is a typo? without a mask?

              See here is my rfc1918 alias table I created entries

              rfctable.jpg

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              I 1 Reply Last reply Reply Quote 0
              • I
                interessierter @johnpoz
                last edited by interessierter

                @johnpoz I dont know but I guess it will not solve the issue right?

                I have for my main network right now 192.168.1.0/24
                vlan 10.10.23.99/24
                vlan2 10.20.23.99/24
                vlan3 10.30.23.99/24
                vlan4 10.40.23.99/24
                vlan5 10.45.23.99/24

                My 192 Netz only contains 192.168.1.0/24, because I want to block requests to this network

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @interessierter
                  last edited by

                  @interessierter I get that.. But your not showing that the table actually loaded.

                  And your rule is not triggering from the 0/0 in the states column.. Why its not is the question.. Maybe the table didn't load? Maybe your client isn't going through pfsense?

                  I don't see any other rules above it that would allow the traffic..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  I 1 Reply Last reply Reply Quote 0
                  • I
                    interessierter @johnpoz
                    last edited by johnpoz

                    @johnpoz What table you want to see?

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @interessierter
                      last edited by johnpoz

                      @interessierter

                      The table alias you created the 192_netz table.

                      What version of pfsense are you running exactly? There was some issues in the dev versions the other day where state tables not counting.. and all showing 0/0

                      Alias tables normally do not populate until used in a rule.. But lets make sure the alias you created actually created the table and put in the 192.168.1.0/24 network.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      I 1 Reply Last reply Reply Quote 0
                      • I
                        interessierter @johnpoz
                        last edited by

                        @johnpoz ab1daade-50fd-4118-95d1-c1eb6bf9d130-image.png

                        4657009e-f1ba-4677-8691-308db19293a2-image.png

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @interessierter
                          last edited by johnpoz

                          @interessierter dude that is not the actual TABLE that is created from the alias..

                          Go to the diagnostic menu, pick tables then select your 192_netz table.. Does it list this network, do you see the table in the table drop down?

                          See my above example showing my rfc1918 table created from my rfc1918 alias.

                          What I am trying to verify is this

                          verify.jpg

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          I 1 Reply Last reply Reply Quote 0
                          • I
                            interessierter @johnpoz
                            last edited by

                            @johnpoz said in VLAN an Firewall rule not matching:

                            @interessierter dude that is not the actual TABLE that is created from the alias..

                            Go to the diagnostic menu, pick tables then select your 192_netz table.. Does it list this network, do you see the table in the table drop down?

                            See my above example showing my rfc1918 table created from my rfc1918 alias.

                            What I am trying to verify is this

                            verify.jpg

                            Sorry do you mean here? If yes, the 192_Netz is not here:
                            79112fab-f15f-4383-bac2-73354be3a301-image.png

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @interessierter
                              last edited by

                              @interessierter well if you do not see your table populated, then that would explain why that rule is not working.

                              As I highlighted, tables that you create with an alias are not populated until they are put into a rule, and the rule is loaded.

                              If your not seeing the table listed under diagnostics. Then no it wouldn't work..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              I 1 Reply Last reply Reply Quote 0
                              • I
                                interessierter @johnpoz
                                last edited by

                                @johnpoz said in VLAN an Firewall rule not matching:

                                @interessierter well if you do not see your table populated, then that would explain why that rule is not working.

                                As I highlighted, tables that you create with an alias are not populated until they are put into a rule, and the rule is loaded.

                                If your not seeing the table listed under diagnostics. Then no it wouldn't work..

                                But what did I wrong? I have saved and applied the rule after creating, and I m sure that the firewall was also rebooted in the time between (what should be anyway not required).

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @interessierter
                                  last edited by

                                  @interessierter You sure your not seeing a error about memory? You sure look to have a lot of aliases..

                                  And none of your rules show any hits at all - they all show 0/0 for states.

                                  When you have lots entries in your tables - it can cause a memory issue.

                                  There are many a thread related to this about. Here for example

                                  https://forum.netgate.com/topic/154266/error-s-loading-the-rules-tmp-rules-debug-28-cannot-define-table-pfb_pri2_alienvault_v4-cannot-allocate-memory

                                  Have you increased your table entries?

                                  maxtable.jpg

                                  This setting is system / advanced / firewall & nat

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • Bob.DigB
                                    Bob.Dig LAYER 8
                                    last edited by Bob.Dig

                                    This post is deleted!
                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Bob.Dig
                                      last edited by

                                      @bob-dig said in VLAN an Firewall rule not matching:

                                      It looks like an alias can't start with a number

                                      Looks to be working here..

                                      test.jpg

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      Bob.DigB 1 Reply Last reply Reply Quote 1
                                      • Bob.DigB
                                        Bob.Dig LAYER 8 @johnpoz
                                        last edited by Bob.Dig

                                        @johnpoz You are right, I had no rule using it. Working here too.

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Bob.Dig
                                          last edited by johnpoz

                                          @bob-dig no problem - it was a good check to be sure.

                                          if I had to "GUESS" from how many aliases he has setup, and I see some there labeled IPv6, etc..

                                          He needs to adjust his max table entries.. Maybe his not seeing the error that should show up when rules don't load because of allocation of memory.. I would assume that TOP_v6 rule would be quite large..

                                          I also don't like that none of his rules showing any hits at all 0/0 there for states..

                                          His any any IPv4 rule he shows for sure should show something vs 0/0.. That is if anything is hitting that interface at all for traffic. But tables in rules don't actually have to trigger to populate - they just need to be used in a rule. And the rules reloaded, which would happen when you hit apply.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          I 1 Reply Last reply Reply Quote 0
                                          • I
                                            interessierter @johnpoz
                                            last edited by

                                            @johnpoz said in VLAN an Firewall rule not matching:

                                            @bob-dig no problem - it was a good check to be sure.

                                            if I had to "GUESS" from how many aliases he has setup, and I see some there labeled IPv6, etc..

                                            He needs to adjust his max table entries.. Maybe his not seeing the error that should show up when rules don't load because of allocation of memory.. I would assume that TOP_v6 rule would be quite large..

                                            I also don't like that none of his rules showing any hits at all 0/0 there for states..

                                            His any any IPv4 rule he shows for sure should show something vs 0/0.. That is if anything is hitting that interface at all for traffic. But tables in rules don't actually have to trigger to populate - they just need to be used in a rule. And the rules reloaded, which would happen when you hit apply.

                                            I can change the name of the alias. This appliance have 16GB memory, and the utilization show 9%.
                                            e4c2f98a-96a2-468e-802d-96ba5f08a7bb-image.png

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.