Best topology for my network
-
Alright, I made the leap and deployed the site.
Here's what I ended up doing. It appears to be going well. The only hiccup right now is that I can't access the interface of my AP unless I'm attached to its base wifi network, or wired into one of its ports. I'm not sure if it's just they way it goes or what. I put an ANY/ANY/ANY rule on it's interface but no change.
So what I want to do now is make sure that the wireless network with all the HomeKit devices on it can be accessed from my other subnets, but that it cannot leak back into them or get on the internet.
-
@tknospdr said in Best topology for my network:
I put an ANY/ANY/ANY rule on it's interface but no change.
So what I want to do now is make sure that the wireless network with all the HomeKit devices on it can be accessed from my other subnets, but that it cannot leak back into them or get on the internet.
You'll need firewall rule: pass tcp/udp LANnet Destination ailas - subnet with all Homekit devices or Interface
Then, you'll need rule: block any ailas or subnet with all homekit devices or interface destination: any -
@NollipfSense said in Best topology for my network:
You'll need firewall rule: pass tcp/udp LANnet Destination ailas - subnet with all Homekit devices or Interface
I already have an open 'pass' rule on the LAN, so that should cover that part right?
I mean, I may need an explicit rule in the future if I delete the default rule but for now I'm good here yes?Then, you'll need rule: block any ailas or subnet with all homekit devices or interface destination: any
Cool, that will still allow responding to traffic from other subnets TOO HomeKit devices right?
Also, just poking around but would this work just as good?
If I'm wrong, I'm wrong. I'm just trying to learn...
Rules - ETH3 is my HomeKit adapter from the pfS box. -
@tknospdr In your block rule, the destination should be any...
-
@NollipfSense said in Best topology for my network:
@tknospdr In your block rule, the destination should be any...
My rule says if traffic hits the adapter for ETH3 coming from ETH3 network and it's destined for anything besides ETH3 network, block it.
Doesn't it?If I make that same rule but block ANY destination the devices won't be able to talk among themselves, right?
Or am I reading too much into how rules work.
I really need an easy to understand primer on how the pf FW rules work. I always feel like I've almost got it, but then my rules never seem to work like I expect them to.
-
@tknospdr rules apply on an interface as packets arrive on that interface. They apply in order top down.
https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.htmlPackets from a LAN device to another LAN device will not go through the firewall.
Packets to a device on another network need to be allowed by that server’s firewall if it has one. Some allow only their own subnet by default.
-
@tknospdr Yes the firewall will not filter traffic destined to the same subnet as it originated from. This is because the traffic will be directed by the switch and never actually go to the firewall.
-
@tknospdr rules apply on an interface as packets arrive on that interface. They apply in order top down.
https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.htmlThanks for that, reading through it all now, but I think what I need is multiple practical examples. I'll just keep making rules and asking the hive mind if they're right before I turn them on
Packets from a LAN device to another LAN device will not go through the firewall.
Packets to a device on another network need to be allowed by that server’s firewall if it has one. Some allow only their own subnet by default.
@tknospdr Yes the firewall will not filter traffic destined to the same subnet as it originated from. This is because the traffic will be directed by the switch and never actually go to the firewall.
Okay, so that's good info to know.
Now my question is...
Is there a functional difference between a rule denying all traffic on 'ANY' vs denying all traffic !ETH3 net "not matching" originating LAN?
-
@tknospdr The first option will match traffic originated from this lan interface and destined to pfsense or other networks, the second option does not.
-
@Austin-0
So what DOES the 2nd option do? -
@tknospdr It would not match traffic coming from the interface and destined to the firewall or other networks.
-
Okay, here's where I get confused then, because to me saying:
If source is ETH3, but destination is NOT ETH3, drop the packets
Like the bottom rule hereSeems like the most efficient way to express a rule where you want all outbound (from the subnet) packets dropped unless they match an incoming state.
What's the flaw in my thinking?
And seriously, I'm not being argumentative, this is just the best way for me to learn. -
@tknospdr It is a subtle difference but it's possible to have a network behind ETH3 that is routed through ETH3 but is a different subnet. It's not a common setup though so if you're not routing internal traffic then there's not really a difference.
Your example is only blocking "ETH3 Net" but the default block rule would block it.
Your example is also invalid btw...which interface is this ruleset on? If it is on ETH3, the destination can never be ETH3. If it is not on ETH3, then the source for the last rule can never be ETH3 Net.
-
@tknospdr said in Best topology for my network:
What's the flaw in my thinking?
And seriously, I'm not being argumentative, this is just the best way for me to learn.
If you say that, then you're. As SteveTS said, you cannot have source and the destination the same...that's not how network works.
Would you go to the airport, say JFK (source or origination) to catch a flight going to JFK destination? You won't find any airline. Or, if you say I want to drop flights going to destination JFK, if the source or origination is JFK...you wouldn't find any flights to drop because no airline flies that route either.Makes sense?
-
@SteveITS said in Best topology for my network:
@tknospdr It is a subtle difference but it's possible to have a network behind ETH3 that is routed through ETH3 but is a different subnet. It's not a common setup though so if you're not routing internal traffic then there's not really a difference.
Are you talking about a VLAN, or something else. Because I do have 2 VLANs traversing ETH3. If those don't count I don't want to learn any other stuff I don't have to deal with right now.
My ears are already smoking with this learning module.Your example is only blocking "ETH3 Net" but the default block rule would block it.
The default block rules that I keep seeing mentioned are implied right? I don't actually see anything in any of the FW rule lists so it's just "zero rules = block everything" right?
Your example is also invalid btw...which interface is this ruleset on?
The ruleset is on ETH3
If it is on ETH3, the destination can never be ETH3.
I don't understand this. You can't make a rule on a subnet regarding traffic on itself?
If it is not on ETH3, then the source for the last rule can never be ETH3 Net.
Similar question... You can't make a rule saying for incoming packets on adapter ETH2, if the source is ETH3 do X?
-
@NollipfSense said in Best topology for my network:
Makes sense?
What you're saying makes sense, but I didn't think that's what I was saying.
I thought the rule I created said:
If I go to JFK, show me a list of flights that !JFK (are not destined for JFK), then ground them so they can't leave the airport. Effectively grounding ALL flights out of JFK.
It seems like I'm misunderstanding the usage of 'Invert match', so what would I use that for?
I thought it meant "everything that is not X", but clearly that's faulty thinking. -
@tknospdr said in Best topology for my network:
If I go to JFK, show me a list of flights that !JFK (are not destined for JFK), then ground them so they can't leave the airport. Effectively grounding ALL flights out of JFK.
But, the thing is there is no such list and will never be such list; so, there will be no flights to ground ever. These two threads should help you understand "invert match:" https://forum.netgate.com/topic/100836/firewall-invert-match-question - https://www.reddit.com/r/PFSENSE/comments/lyxkoj/invert_match/
-
The list IS the rule.
Sorry for being so dense, but those threads basically say the same thing I'm saying.
If the source of the packet is ETH3 net, and it's destination is NOT ETH3 net, block it.
I'm sure there's an "Ah ha!" moment ahead, I just haven't reached that nirvana yet.
There's some crazy subtle difference I'm not picking up on. -
@tknospdr said in Best topology for my network:
You can't make a rule on a subnet regarding traffic on itself?
Packets from ETH3-PC1 to ETH-PC2 should not go to the router, they go across the switch, from one port to another.
Though is is interesting your top two rules show matching traffic which makes me wonder what's going on...
typically a packet arriving from ETH3 at the router would be going anywhere else except ETH3.
-
My pfS box has 4 un-switched 2.5GbE ports on it.
ETH0 is WAN, ETH1 is LAN, I'm not currently using ETH2, and ETH3 goes to my WAP which hosts 3 different subnets.
10.100.10.0 is my IOT/HomeKit stuff
10.100.20.0 is on VLAN20 for wifi computers
10.100.30.0 is on VLAN30 for Nintendo Switches and other older wifi stuff that can't do RADIUS authIf you click the link in the 4th post you can see a crude drawing of my network (I added the 3rd wifi network since my masterpiece)
