VLAN to LAN ping always possible despite rules

Autourdupc

Hello.

After so many times spent to find what is wrong...

PC Engines APU2 - BIOS Coreboot v4.13.0.2
pfsense 2.5.2-RELEASE (amd64)
FreeBSD 12.2-STABLE

The settings
WAN is on igb0
LAN is 192.168.20.0/24 on igb2
VLAN is 192.168.253.0/24 on igb2

Purpose of VLAN : IPCams network
Devices on VLAN must be isolated from LAN
Devices on LAN must get access on devices on VLAN.

I did all the settings and got the following :
Devices on the LAN can access Internet -> OK (great !)
Devices on the VLAn can access Internt -> OK (great !)
Devices on LAN can access devices on VLAN -> OK (great !)
Devices on VLAN are not able to access devices on LAN -> OK (great !)

I did a test :
Connecting a computer on VLAN (it gets IP 192.168.253.2 from DHCP on VLAN).
Ping 192.168.20.104 from computer -> No ping (great !)

From GUI on pfsense : ping 192.168.20.104 from VLAN -> Ping is ok (bad !!!)

My question is :
Why is pfsense able to ping LAN network from VLAN ?
It should not, according to rules that are working.

Is this a bug ?

johnpoz

@autourdupc said in VLAN to LAN ping always possible despite rules:

From GUI on pfsense : ping 192.168.20.104 from VLAN -> Ping is ok (bad !!!)

Why would you think a rule on vlan would stop pfsense from pinging this device just because you set the source IP to be vlan IP?

Pfsense is allowed to do whatever it wants ;)

Via hidden rules.

[21.05.2-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep "let out"
pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"

The interface rules wouldn't be evaluated for traffic pfsense is generating - since the traffic didn't actually enter the vlan interface from the vlan.

Autourdupc

@johnpoz said in VLAN to LAN ping always possible despite rules:

The interface rules wouldn't be evaluated for traffic pfsense is generating - since the traffic didn't actually enter the vlan interface from the vlan.

Hi !

I tought that GUI ping would help me to check / verify my settings...
After spending 2 full days to check, undo/ redo, etc... all the settings, I tought that my isolation was not correct.
This is in last tests that I use a computer on the VLAn to check... and was working as expecting.
I would bet that ping from GUI would do the same as ping from an external device.

viragomann

@autourdupc said in VLAN to LAN ping always possible despite rules:

I would bet that ping from GUI would do the same as ping from an external device.

That is meant to check for proper network configuration of the destination device, but not for testing user rules at all.

johnpoz

@autourdupc said in VLAN to LAN ping always possible despite rules:

I would bet that ping from GUI would do the same as ping from an external device.

Nope.. testing from pfsense itself is good check of connectivity, that pfsense can talk to an IP, and changing the source IP checks that client can back to that IP, etc. But its not a valid check of an interfaces firewall rules.

Same way checking a port forward from an internal device is not a valid check of a port forward. To check a port forward you need to be external..

Autourdupc

@johnpoz said in VLAN to LAN ping always possible despite rules:

Nope.. testing from pfsense itself is good check of connectivity,

Thanks to all of you for your explanations...
Next time, i will ask community before spending soo much time !

But now, I'm stronger because I know !

johnpoz

@autourdupc said in VLAN to LAN ping always possible despite rules:

Next time, i will ask community before spending soo much time !

What we are here for.. If there is some issue you have question on - or not sure if your understanding something correctly.. Yup just stop on by, here to help.