need help: pfBlockerNG with L3 switch with multiple subnets on LAN

mzeid

Hello,

I've googled around and I;m stuck with this one.
I have VLANs that are routed on L3 cisco switch, the default gateway for the L3 switch (and all subnets) is the pfSense firewall.
I made all the necessary firewall rules and static routes, and pfSense is working fine as a firewall.
No NATing here.

topology like this:
subnets=L3 switch=FW01(pfSense)=switch=FW02=internet modems

everything was working fine, but pfBlockerNG is only working with LAN subnet. Anything routed behind doesn't not. nslookup from a windows client replies back with
*** UnKnown can't find ####: Query refused.

I'm 90% sure this is a firewall rules thing, can you please help me with any hints? thanks

mcury

@mzeid Go to:

Then, add the subnets not directly connected to the firewall.

mzeid

@mcury

You nailed it dear, that solved the problem.

Never thought there is an access list to the DNS resolver, and it makes sense to protect it from non-trusted networks and DDoS attacks.
I'm still new to pfSense, used it years ago for only basic stuff.

Thank you very much.

mcury

@mzeid said in need help: pfBlockerNG with L3 switch with multiple subnets on LAN:

You nailed it dear, that solved the problem.

That's good to hear.

johnpoz

@mzeid said in need help: pfBlockerNG with L3 switch with multiple subnets on LAN:

everything was working fine, but pfBlockerNG is only working with LAN subnet

Glad you got it sorted, but this points to design problem to be honest. You should not connect downstream router via "lan" if there are other devices on the lan. Downstream routers should be connected via a transit network (no hosts) or you can run into an issue with asymmetrical traffic flow. Unless you do host routing on the devices on the lan network. Or you downstream router is natting, etc.

Unless none of the devices on the lan never talk to downstream devices.

Downstream sends Syn to client on the lan network, the device sends it syn,ack to its default gateway because it has no route to this network. Pfsense never saw the syn, so there is no state.. And traffic is denied.

This is a better setup when you have a downstream router

Maybe devices on lan and your downstream never talk to each other? But whenever you connect routers together, it should be a transit network (no hosts on it only routers) or you can have issue, especially when a stateful firewall is doing the routing.