Setup to allow admin access only from OPT1. Is this correct?
-
The allow rule at the bottom on the ADMIN_ONLY rules is allowing access to anywhere. You should remove/disable that to prevent access to the internet.
The reject rule at the top of the LAN rules should probably be to 'This Firewall' but only on port 443 (unless you changed that port). That way hosts on LAN will not be able to access the firewall GUI on any IP owned by the firewall but will still be able to access the LAN IP for DNS, NTP etc.
Steve
-
Thank you very much. I have applied the settings you gave me. However, when I connect to SoftbankAir (home WiFi) with a wired WAN, PackageManager and Netgate Service And Support are still loading and not connecting. I was getting DHCP messages, but this was fixed by restarting Netgate. 192.168.3.1 was the address I used to set the LAN address in SetupWizard, and then it stopped working. I had to restore the backup settings via the console because they stopped working after that. It may be faster to do a FactoryReset and build from scratch again, but I would like to be able to fix it by re-configuring the settings via GUI if possible.
! alt text
-
@Yet_learningPFSense said in Setup to allow admin access only from OPT1. Is this correct?:
when I connect to SoftbankAir (home WiFi) with a wired WAN, PackageManager and Netgate Service And Support are still loading and not connecting
The WAN is using an IP in the 192.168.3.0/24 subnet so if either LAN or ADMIN_ONLY was also set to that it would have been conflicting.
-
@stephenw10 Thank you. It seems that what happened before on PfBlockerNG, where the rules were deleted in the GUI but remained applied, was also happening in the interface settings. neither ADMIN_ONLY nor LAN were 192.168.3.1, but after initialization and setting the same rules, I was able to create the desired net connection environment! After initializing and setting the same rules, I was able to create the desired internet connection environment!
(Correction, I assumed that the 192.168.3.1 address was assigned to either LAN or ADMIN_ONLY and did not investigate the WAN one. (Perhaps if I had selected the WAN tab, it would have come up.)
I am glad to have solved one of the problems I had been struggling with for many years. Thank you very much for your help.
-
Sorry, one last question. I have successfully set up the admin page to be accessible only from ADMIN_ONLY in OPT, but I can't seem to browse the Internet from my laptop connected to the LAN side. I would like to know if there is any misconfiguration.
I have installed darkstat and ntopng so that I can access it only from ADMIN_ONLY. Hmmm...what is wrong with the settings?
-
What do your LAN rules look like now?
-
Thanks! I forgot to post the images I had uploaded to imgur, but when I changed the LAN rules to the ones mentioned by stephenw10, I couldn't communicate, but then I remembered that I hadn't rebooted, so I rebooted and was able to connect to the internet successfully!
! PFSense LAN.OPT1 Rule
it might have added a Reject rule for PrivateNet.I still feel that if I ask someone or something, it will be solved in whatever form it takes. Thank you very much. Now I have one more foundation for peace of mind.
-
@Yet_learningPFSense FWIW the last rule on LAN (udp/53) will never trigger because the allow to any rule above it will match first. Not a problem, it’s just unnecessary.
-
Thanks, i think so too. I have removed it.
-
What's in the PrivateNet alias?
-
https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/opt-lan.html
I am adding these three items from the guide here
: 192.168.0.0/16
172.16.0.0/12
10.0.0.0/8.
As a general rule, one PC connection per port, .If possible, I would like to block communication between the LAN and the OPT. -
Ah OK. In that case PrivateNet contains the LAN interface address itself so that rule is blocking access to pfSense for DNS. Clients are probably being passed the LAN address to use for DNS (unless you changed it). The firewall are applied from the top down so you need to move that DNS rule above the 'deny to PrivateNet' rule so clients can resolve.
Steve
-
@stephenw10 ok, thanks. I will try to set it up that way.
