No WAN access from inside LANs...
-
So I just ran some experiments that lead me to believe pfSense is blocking my laptop from entering the LAN, IOT and DMZ interfaces, and thus not allowing it to reach the WAN interface.
Using the PC I have on the LAN net, which has rules to allow access to the IOT and DMZ nets I was able to ping all devices, including the 3 pfsense interfacegateways, except for the PC on the IOT net, and the laptop currently connected to the DMZ net. I believe it is normal/standard for PC-to-PC ping not to work...? which explains why I cannot ping PC from the laptop while on the same net.
In order for the above to happen, the traffic had to go to the LAN switch, then the firewall, and down the other nets, and it worked fine.
Then, I connected the laptop to the same LAN net, got a DHCP lease fine, and then tried to repeat the above, but was completely unable to ping anything outside the LAN net, except for the switch on the LAN net.
This to me tells me that the traffic from my laptop is unable to enter the firewall, being blocked by pfSense. Also it would seem both switches are working fine. Actually, we can eliminate teh switches all together, because when I connect the laptop directly to the DMZ interface, where there is no switch at all, I still cannot ping the interface gateway, so the pring "request" is being blocked outright by pfSense, and I cannot get access to the internet.
So is it possible that at some point early on when I first tried to connect the laptop to the my nets, that pfSense decided the laptop was "persona non-grata" and then wrote its MAC address in a database used to block access to the interfaces on the firewall ?
-
@njaimo said in No WAN access from inside LANs...:
that pfSense decided the laptop was "persona non-grata" and then wrote its MAC address in a database used to block access to the interfaces on the firewall ?
No.. are you running a captive portal - if so then you could block a mac..
Does the laptop get a IP from pfsense dhcp server? Are you running static arp in the dhcp server? do you have anything set for deny unknowns or the like in dhcp server?
pfsenes doesn't have a db of macs that it just magically says not going to talk to this guy ;)
-
@johnpoz Thanks for the tips !
not running captive portal, but do have Static ARP option checked on the DHCP Server service page on all 3 interfaces, though not sure what I did, nor what it does.... should I uncheck it ?
..?
-
@njaimo said in No WAN access from inside LANs...:
though not sure what I did, nor what it does....
Then why would you of checked it?
Static as it clearly states - "Only the machines listed below will be able to communicate with the firewall on this interface."
Ie the ones you had created reservations for.. in the static mappings section at the bottom of the dhcp server settings page.
Yes you should uncheck using static arp - unless you clear on what it does and why you would want to use it ;)
-
@johnpoz ...got it. I do have static IP's specified for the 2 other nets (LAN, and IOT), and do have the same box chacked on those, as well as the box on each static IP specifying "create a static ARP table entry".
So went ahead and unchecked the Static ARP option on the DMZ interface, where I have no Static IP entries on the DHCP server page., saved,, and then reconnected the laptop network app, it aquired a DHCP lease (192.168.4.11), but I am still unable to ping the interface gateway (192.168.4.1)... and still no internet access...
-
@njaimo what are you rules on your dmz interface? New interfaces have no rules like the default any on the lan. You have to create them - so unless you have a rule that allows it you would not be able to ping.
btw just creating reservations doesn't mean you should use static arp - going to make it painful adding any new machines, etc. Static arp is a specific use case - where you want complete control and help preventing anything from changing its mac to bypass firewall rules and use a different IP, etc. It really has no use on a home network, even one locked down.. It is to used to mitigate a specific type of attack or issue that might be seen on a network.. Again unless you specifically understand what it is and what it does and why you would want to use it - I would suggest you not set that.
-
@johnpoz here they are, I am blocking traffic to the two other nets, to keep it isolated
-
@njaimo tcp/udp is not icmp - so no those rules would not allow you to ping anything really.
-
@johnpoz ....got it on the ARP, Thank You. Let me change the rule and check.
-
@njaimo btw see my edit above about static arp.. Unless you have a specific use case that would call for that, it really shouldn't be checked.
-
success ! Where can I send you a beer ? ..or two ?
wondering though, while having specified the TCP/UDP traffic as I have it above, should I have not had internet access ? like Google ?
-
@njaimo yeah those would allow access to the internet for tcp/udp, but not if you had your static arp issue, etc. And your blocking access to lan and iot - what are you pointing to for dns on this dmz.. If it was say your lan IP then no you wouldn't of been able to use dns. Which kind of needed to get to say www.google.com ;)
Or if you if you had messed with your outbound nat rules, and taken them off auto without correctly setting nat, etc.
-
learned something new, Thank You !! Thank you All !
-
@njaimo so you're all sorted? If you are unclear on what some feature does, some advice ;) Ask before clicking it - hahah
-
@johnpoz ...got it ! :) Thanks.
BTW -- one more stupid question while I am in the hole for now... ?
Logging into the pfSense GUI via https, if I screw up my password just once, I get locked out for a time... I have looked where I can maybe change this, but have not been able to find it, which is why I had created yet another user with a different password, but it did not help, once I got locked out, I could not even try an alternate user... What am I screwing up on ?
-
@njaimo hmmm - I have never ran into such a thing.. But then again I don't have that enabled.. Nobody can get to my gui but my machine anyway ;)
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html#login-protection
Is that something else you clicked on? ;) I don't recall if that is enabled by default - I wouldn't think so?? But long time since I have used default configs, since when I update even when clean I normally load my last config, etc.
edit: hmm looks like it is enabled by default - did you alter the default settings?
edit2: I just added my PC IP to bypass list, just in case ;) As you say we learn something new everyday - heheh
edit3: And I use a password manager to enter the password, which is quite long and complex that would be just a PITA to enter by hand.. So I can not recall the last time I would of entered the password wrong ;)
-
@johnpoz ...since this is my home, I do not have had need to use ssh from outside, and figured it woudl be easiest to access the GUI via https and a web browser in the net. ...ANd I had a bad case of "click-itis"... LOL
I see there is a max of "10" down in "login protection" on the same page, but I get locked out after the first try, and it takes about 30 minutes to let me try again... I do not recall editing any default settings on this...
-
@njaimo not sure what ssh has to do with anything? Did you open the webgui to the internet?
Did you look in your log for login attempts? What does it say your level of attack was?
-
Your IP will get blocked by sshguard for a few minutes if you try to login and fail three times. If you then fail again it will block you for longer.
You can just add your IP to the whitelist to prevent sshguard triggering against it.sshguard monitors all login attempts not just ssh, confusingly!
Steve
-
Thank you for the replies ! ...sorry for the delay, had to be away from home this morning.
I get blocked after just one failed login (seems its been like that for years) but I do can log in from the other net, which I had not tried before, thank you for that tip. Here is the log, seems the failed logging is considered a level-10
