Setup to allow admin access only from OPT1. Is this correct?
-
@stephenw10 Thank you. It seems that what happened before on PfBlockerNG, where the rules were deleted in the GUI but remained applied, was also happening in the interface settings. neither ADMIN_ONLY nor LAN were 192.168.3.1, but after initialization and setting the same rules, I was able to create the desired net connection environment! After initializing and setting the same rules, I was able to create the desired internet connection environment!
(Correction, I assumed that the 192.168.3.1 address was assigned to either LAN or ADMIN_ONLY and did not investigate the WAN one. (Perhaps if I had selected the WAN tab, it would have come up.)
I am glad to have solved one of the problems I had been struggling with for many years. Thank you very much for your help.
-
Sorry, one last question. I have successfully set up the admin page to be accessible only from ADMIN_ONLY in OPT, but I can't seem to browse the Internet from my laptop connected to the LAN side. I would like to know if there is any misconfiguration.
I have installed darkstat and ntopng so that I can access it only from ADMIN_ONLY. Hmmm...what is wrong with the settings?
-
What do your LAN rules look like now?
-
Thanks! I forgot to post the images I had uploaded to imgur, but when I changed the LAN rules to the ones mentioned by stephenw10, I couldn't communicate, but then I remembered that I hadn't rebooted, so I rebooted and was able to connect to the internet successfully!
! PFSense LAN.OPT1 Rule
it might have added a Reject rule for PrivateNet.I still feel that if I ask someone or something, it will be solved in whatever form it takes. Thank you very much. Now I have one more foundation for peace of mind.
-
@Yet_learningPFSense FWIW the last rule on LAN (udp/53) will never trigger because the allow to any rule above it will match first. Not a problem, it’s just unnecessary.
-
Thanks, i think so too. I have removed it.
-
What's in the PrivateNet alias?
-
https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/opt-lan.html
I am adding these three items from the guide here
: 192.168.0.0/16
172.16.0.0/12
10.0.0.0/8.
As a general rule, one PC connection per port, .If possible, I would like to block communication between the LAN and the OPT. -
Ah OK. In that case PrivateNet contains the LAN interface address itself so that rule is blocking access to pfSense for DNS. Clients are probably being passed the LAN address to use for DNS (unless you changed it). The firewall are applied from the top down so you need to move that DNS rule above the 'deny to PrivateNet' rule so clients can resolve.
Steve
-
@stephenw10 ok, thanks. I will try to set it up that way.
