Best topology for my network

NollipfSense

@tknospdr said in Best topology for my network:

I put an ANY/ANY/ANY rule on it's interface but no change.

So what I want to do now is make sure that the wireless network with all the HomeKit devices on it can be accessed from my other subnets, but that it cannot leak back into them or get on the internet.

You'll need firewall rule: pass tcp/udp LANnet Destination ailas - subnet with all Homekit devices or Interface
Then, you'll need rule: block any ailas or subnet with all homekit devices or interface destination: any

tknospdr

@NollipfSense said in Best topology for my network:

You'll need firewall rule: pass tcp/udp LANnet Destination ailas - subnet with all Homekit devices or Interface

I already have an open 'pass' rule on the LAN, so that should cover that part right?
I mean, I may need an explicit rule in the future if I delete the default rule but for now I'm good here yes?

Then, you'll need rule: block any ailas or subnet with all homekit devices or interface destination: any

Cool, that will still allow responding to traffic from other subnets TOO HomeKit devices right?

Also, just poking around but would this work just as good?
If I'm wrong, I'm wrong. I'm just trying to learn...
Rules - ETH3 is my HomeKit adapter from the pfS box.

NollipfSense

@tknospdr In your block rule, the destination should be any...

tknospdr

@NollipfSense said in Best topology for my network:

@tknospdr In your block rule, the destination should be any...

My rule says if traffic hits the adapter for ETH3 coming from ETH3 network and it's destined for anything besides ETH3 network, block it.
Doesn't it?

If I make that same rule but block ANY destination the devices won't be able to talk among themselves, right?

Or am I reading too much into how rules work.

I really need an easy to understand primer on how the pf FW rules work. I always feel like I've almost got it, but then my rules never seem to work like I expect them to.

SteveITS

@tknospdr rules apply on an interface as packets arrive on that interface. They apply in order top down.
https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.html

Packets from a LAN device to another LAN device will not go through the firewall.

Packets to a device on another network need to be allowed by that server’s firewall if it has one. Some allow only their own subnet by default.

Austin 0

@tknospdr Yes the firewall will not filter traffic destined to the same subnet as it originated from. This is because the traffic will be directed by the switch and never actually go to the firewall.

tknospdr

@tknospdr rules apply on an interface as packets arrive on that interface. They apply in order top down.
https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.html

Thanks for that, reading through it all now, but I think what I need is multiple practical examples. I'll just keep making rules and asking the hive mind if they're right before I turn them on

Packets from a LAN device to another LAN device will not go through the firewall.

Packets to a device on another network need to be allowed by that server’s firewall if it has one. Some allow only their own subnet by default.

@tknospdr Yes the firewall will not filter traffic destined to the same subnet as it originated from. This is because the traffic will be directed by the switch and never actually go to the firewall.

Okay, so that's good info to know.

Now my question is...

Is there a functional difference between a rule denying all traffic on 'ANY' vs denying all traffic !ETH3 net "not matching" originating LAN?

Austin 0

@tknospdr The first option will match traffic originated from this lan interface and destined to pfsense or other networks, the second option does not.

tknospdr

@Austin-0
So what DOES the 2nd option do?

Austin 0

@tknospdr It would not match traffic coming from the interface and destined to the firewall or other networks.

tknospdr

@Austin-0

Okay, here's where I get confused then, because to me saying:

If source is ETH3, but destination is NOT ETH3, drop the packets
Like the bottom rule here

Seems like the most efficient way to express a rule where you want all outbound (from the subnet) packets dropped unless they match an incoming state.

What's the flaw in my thinking?
And seriously, I'm not being argumentative, this is just the best way for me to learn.

SteveITS

@tknospdr It is a subtle difference but it's possible to have a network behind ETH3 that is routed through ETH3 but is a different subnet. It's not a common setup though so if you're not routing internal traffic then there's not really a difference.

Your example is only blocking "ETH3 Net" but the default block rule would block it.

Your example is also invalid btw...which interface is this ruleset on? If it is on ETH3, the destination can never be ETH3. If it is not on ETH3, then the source for the last rule can never be ETH3 Net.

NollipfSense

@tknospdr said in Best topology for my network:

What's the flaw in my thinking?
And seriously, I'm not being argumentative, this is just the best way for me to learn.

Screenshot 2023-07-21 at 11.45.44 AM.png

If you say that, then you're. As SteveTS said, you cannot have source and the destination the same...that's not how network works.
Would you go to the airport, say JFK (source or origination) to catch a flight going to JFK destination? You won't find any airline. Or, if you say I want to drop flights going to destination JFK, if the source or origination is JFK...you wouldn't find any flights to drop because no airline flies that route either.

Makes sense?

tknospdr

@SteveITS said in Best topology for my network:

@tknospdr It is a subtle difference but it's possible to have a network behind ETH3 that is routed through ETH3 but is a different subnet. It's not a common setup though so if you're not routing internal traffic then there's not really a difference.

Are you talking about a VLAN, or something else. Because I do have 2 VLANs traversing ETH3. If those don't count I don't want to learn any other stuff I don't have to deal with right now.
My ears are already smoking with this learning module.

Your example is only blocking "ETH3 Net" but the default block rule would block it.

The default block rules that I keep seeing mentioned are implied right? I don't actually see anything in any of the FW rule lists so it's just "zero rules = block everything" right?

Your example is also invalid btw...which interface is this ruleset on?

The ruleset is on ETH3

If it is on ETH3, the destination can never be ETH3.

I don't understand this. You can't make a rule on a subnet regarding traffic on itself?

If it is not on ETH3, then the source for the last rule can never be ETH3 Net.

Similar question... You can't make a rule saying for incoming packets on adapter ETH2, if the source is ETH3 do X?

tknospdr

@NollipfSense said in Best topology for my network:

Makes sense?

What you're saying makes sense, but I didn't think that's what I was saying.

I thought the rule I created said:

If I go to JFK, show me a list of flights that !JFK (are not destined for JFK), then ground them so they can't leave the airport. Effectively grounding ALL flights out of JFK.

It seems like I'm misunderstanding the usage of 'Invert match', so what would I use that for?
I thought it meant "everything that is not X", but clearly that's faulty thinking.

NollipfSense

@tknospdr said in Best topology for my network:

If I go to JFK, show me a list of flights that !JFK (are not destined for JFK), then ground them so they can't leave the airport. Effectively grounding ALL flights out of JFK.

But, the thing is there is no such list and will never be such list; so, there will be no flights to ground ever. These two threads should help you understand "invert match:" https://forum.netgate.com/topic/100836/firewall-invert-match-question - https://www.reddit.com/r/PFSENSE/comments/lyxkoj/invert_match/

tknospdr

The list IS the rule.

Sorry for being so dense, but those threads basically say the same thing I'm saying.

If the source of the packet is ETH3 net, and it's destination is NOT ETH3 net, block it.

I'm sure there's an "Ah ha!" moment ahead, I just haven't reached that nirvana yet.
There's some crazy subtle difference I'm not picking up on.

SteveITS

@tknospdr said in Best topology for my network:

You can't make a rule on a subnet regarding traffic on itself?

Packets from ETH3-PC1 to ETH-PC2 should not go to the router, they go across the switch, from one port to another.

Though is is interesting your top two rules show matching traffic which makes me wonder what's going on...

typically a packet arriving from ETH3 at the router would be going anywhere else except ETH3.

tknospdr

@SteveITS

My pfS box has 4 un-switched 2.5GbE ports on it.
ETH0 is WAN, ETH1 is LAN, I'm not currently using ETH2, and ETH3 goes to my WAP which hosts 3 different subnets.
10.100.10.0 is my IOT/HomeKit stuff
10.100.20.0 is on VLAN20 for wifi computers
10.100.30.0 is on VLAN30 for Nintendo Switches and other older wifi stuff that can't do RADIUS auth

If you click the link in the 4th post you can see a crude drawing of my network (I added the 3rd wifi network since my masterpiece)

johnpoz

@tknospdr said in Best topology for my network:

I don't understand this. You can't make a rule on a subnet regarding traffic on itself?

You can make the rule - but what would trigger it? As stated, traffic that is to something else on the same network never would go to pfsense.

Traffic is only sent to the router/gateway (pfsense) when the destination is not the local network.

The use of ! rules, while might be useful in some special use case. Are not normally needed, and are harder for humans to read. If you want a rule that allows something on eth3 to go anywhere it wants, then the clearer destination is ANY.. not ! Eth3 Net..

Also your more likely to run into some weirdness when doing such a rule - there have been issues in the past when VIPs are involved for example. Its best to be very explicit in your rules, allow/deny/reject with very specific and easy for human to understand at a glance.

If you want to do allow source eth3 net, destination !Eth3 Net. sure go ahead.. But since no traffic would be sent to pfsense anyway if the destination was eth3 net what is the point. You would also by that rule be blocking access to pfsense IPs on eth3 net.. Which you prob using for dns, ntp, or wanting to ping for connectivity check, etc.