firewall rules issue?
-
Hi there!
My first post here, I don't know if the title is the best title for this case, but let's go for the issue.
My cenario:
Vlan 10 - 172.16.1.0/24 (LAN)
Vlan 20 - 10.0.0.0/24 (WIFI)Host 1 (Vlan 10 - LAN) - 172.16.1.15 - Unifi controller
AP-01 (Vlan 20 - WIFI) - 10.0.0.14 - UAP-AC-LRHost 1 pings to AP-01, but AP-01 don't ping to Host 1
I've created firewall rules as you can see in the print attached below.
In the Host 1, I already disable windows firewall and I removed the antivirus.
AP-01 pings for the firewall IP (172.16.1.254) but not for any other IP in the LAN net.
Any ideas?
-
@rccruz-0 how would those work.. When would LAN be source into vlan interface? When or how could vlan20 be source into your lan?
Rules are evaluated as traffic enters an interface from the network attached.. There is no way that lan is the source into vlan..
Evaluated top down, first rule to trigger wins, no other rule is evaluated.
What are you wanting to happen?
Those lan rules just make no sense at all.. How would vlan20 be source of traffic into the lan, to get to the lan net?
https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html
-
@johnpoz I assign VLAN 10, to LAN interface.
-
@johnpoz Like you said, rules need to be inbound. So, for the LAN traffic reache VLAN 20 network, the source must be LAN in the VLAN 20 rules. In the other way, to traffic from VLAN 20 network reache the LAN network, the source must be VLAN 20 in the LAN rules.
I'm so wrong like you said?
-
@rccruz-0 said in firewall rules issue?:
n VLAN 10, to LAN interface.
And what does that have to do with anything? You can run multiple vlans on a physical interface - what does that have to do with rules that make no sense?
Do you not understand what a vlan is? Are you thinking you just going to run multiple IP ranges on the same actual interface?
the source must be LAN in the VLAN 20 rules
NO... Traffic is only filtered on the inbound direction.. How would the source IP be your lan IP inbound into the vlan interface from the vlan network? How? The rule makes no sense..
Did you even read the first couple of sentences to what I linked too?
-
@johnpoz said in firewall rules issue?:
And what does that have to do with anything? You can run multiple vlans on a physical interface - what does that have to do with rules that make no sense?
Do you not understand what a vlan is? Are you thinking you just going to run multiple IP ranges on the same actual interface?Right, makes no sense, that's why I'm here, I need help to understand how to make it right.
I need comunicate the AP-01 to Host 1, because the unifi controller. One way is ok, te return com is not working, can you help me?
-
@rccruz-0 so your AP is on a different network than your controller? You would have to do L3 adoption..
What do you not understand about how rules are evaluated?
Your also forcing traffic out a gateway which is going to cause you grief as well, how would vlan get to your LAN, when your sending traffic out your wan gateway?
-
@johnpoz said in firewall rules issue?:
I have two WAN Gateways, and I separate traffic in two as well.
Gateway 1 for LAN traffic, and Gateway 2 for wifi traffic. Reading some article in web about this, they suggested set that rule to send traffic to a especific WAN.
I understand what you said about send all traffic to WAN, but I think if a put that rule after the "no sense rule". That would work.
-
@rccruz-0 yes bypassing policy routing.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#bypassing-policy-routing
But again its just NOT possible that your lan net would be a source of traffic inbound into your vlan interface.
-
@johnpoz ok. Thank you. I understand that.
I will look for an alternative way to solve my problem.
-
@rccruz-0 said in firewall rules issue?:
I will look for an alternative way to solve my problem.
What problem.. You have rules that would never work ever, because they just could never match.
If you want to allow or block traffic from lan to your vlan, then those rules go on your LAN interface with source LAN net..
if you want to block or allow traffic from your vlan to your lan, those would go on your vlan interface with source vlan..
For your AP to be adopted by your controller you would need to be on the same network.. Or you would need to use L3 adoption. And yes your rules on your interface(s) would need to allow the traffic you want to allow for the L3 adoption to work.
-
@johnpoz Yes, I understand those rules will never work. I'll remove then.
Now you talking. I'll set the rules you mentioned and post the result here.
Thank you !!!
