Block internet for one IP
-
Hello,
Need some help with pfsense.
I want to block internet access for one internal IP (static ip 192.168.11.11) that is on the main LAN.
I've made this block rule in the section: "Firewall\Rules\LAN", but it is not working for some reason.Where i'm making mistake?
T.Y.
-
@pfsense57352 rules are evaluated top down, first rule to trigger wins, no other rules are evaluated. You would need to put that block above your rule that allows internet for everything.
Keep in mind once a state is created that allows an IP to go somewhere, that state will allow the traffic before the new block rule is evaluated.
So if you want to block 192.168.11.1 from going to the internet, you would need to either kill all the states to the internet for that IP, or wait for them to time out before your rule will take effect.
-
@johnpoz said in Block internet for one IP:
Keep in mind once a state is created that allows an IP to go somewhere, that state will allow the traffic before the new block rule is evaluated.
So if you want to block 192.168.11.1 from going to the internet, you would need to either kill all the states to the internet for that IP, or wait for them to time out before your rule will take effect.
Thank you very much!! the problem indeed was the state.
But then i have another question? How often states are updated (cleared)? I've created this rule ±12 hours ago. But it did not timed out. Only after i manually deleted state for specific zabbix port, blocking started to work. -
@pfsense57352 a state can stay open forever if traffic is flowing over it.. Only when traffic stop will the state finally time out. Normally what happens is the devices close the connection when they are done talking by sending fin..
-
@pfsense57352 An add on to what John said: https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#new-rules-are-not-applied
-
@SteveITS said in Block internet for one IP:
@pfsense57352 An add on to what John said: https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#new-rules-are-not-applied
Thank you!
I've started my journey with pfsense yesterday, so i'm brand new with this router/firewall. But i already like it much better than mikrotik.
