How to set the same VLANs between the switch and PfSense

JT40

@patch said in How to set the same VLANs between the switch and PfSense:

@jt40 said in How to set the same VLANs between the switch and PfSense:

I don't have any other rule on that interface,

The default settings are

WAN: Common functional default setting for a WAN

LAN: Common functional default setting for a LAN including an anti-lockout rule

OPT1... or VLAN: No rules other the default deny all rule.

So if you add a VLAN or use OPT as an extra LAN you need rules similar to the default LAN rules. Similarly if you use OPT as an extra WAN you need rules similar to the default WAN rules.

I removed all the default rules, plus when I create a new interface there is no rule at all.
Is the "DENY ALL in INBOUND" rule implicit for each interface? If so, where I can see it?

@johnpoz said in How to set the same VLANs between the switch and PfSense:

@steveits said in How to set the same VLANs between the switch and PfSense:

Firewall rules don't sent traffic anywhere.

Unless your policy routing ;)

@jt40 said in How to set the same VLANs between the switch and PfSense:

LAN5 (send everything from LAN5 network to WAN address)

What does that even mean? That isn't going to get to the internet..

In my head, that means that every address of the network in the LAN5 interface can reach the WAN address, which is directly connected to a gateway. I don't know if I see it correctly, but this is how it makes sense for me :D .

WAN (accept everything that comes from LAN5 network

How would the WAN ever see any traffic from LAN5?

I probably didn't mention it in this way, but due to the ISP router in front of, that WAN is actually a LAN.
I'd be curious to know if it would have been different with a real WAN.

Rules are evaluated as traffic enters an interface from the network it is attached too... WAN could never see Lan5 traffic as source..

Strange, so how the routing would work?
Where and how should I specify the rule to allow traffic from one LAN to internet?

Please post up these rules you created..

The rules are in the previous message, I didn't omit details or rules, I could give a screenshot but it's really what I described.

SteveITS

@jt40 said in How to set the same VLANs between the switch and PfSense:

Where and how should I specify the rule to allow traffic from one LAN to internet?

On interface LAN5 the default should be no rules. The implicit deny rule is not explicit, therefore not listed. Add a rule to allow from LAN5 Net to any. If you also want to block LAN5 from getting to LAN, add a rule above that rule, to deny from LAN5 Net to LAN Net.

JT40

Oh ok, I think I was a bit drunk, if there is no rule then is DENY ALL, so all the INBOUND traffic is DENY currently because I have no rule as such, I think it works in this way as any other router :D , I tested it in the LAN just in case.

JT40

This Askimet spam filter is against me, I didn't post any link and I still can't write the message I need :D

johnpoz

@jt40 said in How to set the same VLANs between the switch and PfSense:

I could give a screenshot but it's really what I described.

What you described doesn't make any sense - lan5 could not or would or could ever be source of traffic into the wan interface..

JT40

In response to Steve -->
Is it not already disabled by default? Please look my message above.

If you talk about the same LAN instead (for example LAN2 to LAN2), I don't want the communication between the devices on the same LAN, but I also don't want the communication between different LANs for now.
At the moment, due to no rule in place I think it's DENY ALL between LANs, I need to check between the devices of the same LAN.

In any case, I'll configure such things in VLAN, where below that VLAN there will be a switch, which by itself will have the client isolation rule enabled.
I need to check what I need to do on the PfSense firewall about it...

johnpoz

@jt40 said in How to set the same VLANs between the switch and PfSense:

I don't want the communication between the devices on the same LAN

pfsense has nothing to do with communication between devices on the network (lan) Pfsense is a router, it routes and firewall traffic between networks. It is not involved in devices talking to each other on the same network, only for traffic wanting to leave a network.

If you don't want devices talking to each other on the same network you would need to do that at your switch - lookup up a private vlan. Or via wireless this is often called AP or Client isolation.

https://en.wikipedia.org/wiki/Private_VLAN

https://support.denon.com/app/answers/detail/a_id/3746/~/wireless%2C-ap-or-client-isolation

SteveITS

@jt40 If you allow LAN2 to Any, that will allow to LAN5 as well. LAN5 is "any."

You can't do much about devices on the same network communicating. That normally is handled by a switch and those packets don't even get to the router.

Patch

@jt40 said in How to set the same VLANs between the switch and PfSense:

if there is no rule then is DENY ALL, so all the INBOUND traffic is DENY currently because I have no rule as such

Rules are evaluated from the top down.
The first rule which matches is used and no further rules are evaluated.
If no entered rules match the the packet is dropped / blocked.

So if no rules are entered every packet falls off the bottom of the rule list and is blocked.

I find it simplest to order my rules as

Allowed local traffic
Reject other local traffic
Allowed Internet traffic
Block other Internet traffic

An example of which for LAN2 is:
Firewall example.jpg

Bob.Dig

@jt40 said in How to set the same VLANs between the switch and PfSense:

This Askimet spam filter is against me, I didn't post any link and I still can't write the message I need :D

I am with Akismet on this one.

JT40

@bob-dig said in How to set the same VLANs between the switch and PfSense:

@jt40 said in How to set the same VLANs between the switch and PfSense:

This Askimet spam filter is against me, I didn't post any link and I still can't write the message I need :D

I am with Akismet on this one.

@patch said in How to set the same VLANs between the switch and PfSense:

@jt40 said in How to set the same VLANs between the switch and PfSense:

if there is no rule then is DENY ALL, so all the INBOUND traffic is DENY currently because I have no rule as such

Rules are evaluated from the top down.

The first rule which matches is used and no further rules are evaluated.

If no entered rules match the the packet is dropped / blocked.

So if no rules are entered every packet falls off the bottom of the rule list and is blocked.

I find it simplest to order my rules as

Allowed local traffic

Block other local traffic

Allowed Internet traffic

Block other Internet traffic

An example of which for LAN2 is:

Thank you.
I see that you have set also the REJECT rules, but my point is, is it not by default?
Precisely, I would expect DROP as by default, not REJECT.

Look at the simplest case, if I have a rule do to something, I expect that rule to be evaluated.
If the device asks for something else and the rule is not present, I expect the packets to be dropped automatically...
This is also the easiest way a firewall can work to make my life easier :D

johnpoz

@jt40 the default is drop, ie just block..

But internally it is sometime better to reject vs just drop. I want to let my internal client you can not go there right away - via a reject. Vs letting it bang its head with retrans trying to figure out why he is not getting an answer.

Externally no you would almost never want to send a reject to something out on the internet.. But internally - if your going to on purpose prevent something like vlan x from talking to vlan y.. its better to just let them know - hey stop trying to go there ;)

If the device asks for something else and the rule is not present, I expect the packets to be dropped automatically...

That is how it works.. If there is not allowed, then traffic dropped gone over this how many times already.. But yet to see a picture of your rules.. You have been told multiple times that pfsense will not route traffic unless there is an allow rule.

If the spam system is preventing you from uploading a picture - then link to it somewhere else, use something like my picture is here somewhere . domain . tld / whatever even if you have to but. But what I can tell you yet again yes default is deny. No rule to allow, traffic is dropped.

If you want to actually see it - then look at the full rule set. Since this default deny is not shown in the gui..

[21.05.2-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep "Default deny rule"
block drop in inet all label "Default deny rule IPv4"
block drop out inet all label "Default deny rule IPv4"
block drop in inet6 all label "Default deny rule IPv6"
block drop out inet6 all label "Default deny rule IPv6"
[21.05.2-RELEASE][admin@sg4860.local.lan]/root: