PfSense Rule ignored on TCP when communication happens between two directly connected networks

Blebitu

Hello.
I'm using proxmox as HV. My pfSense is virtuallized in VM, on version 2.7.2-RELEASE.

I have two networks:
LAN (infra): 192.168.10.0/24
OPT1 (end-users hosts): 192.168.20.0/24

My PfSense has 3 interfaces WAN,LAN,OPT1, all with IP in <network>.102
I have a squid proxy with 2 interfaces (one on LAN and another one on OPT1), both in <network>.105.

I have a Linux infra server on LAN in 192.168.10.107, with it's gateway to my PfSense so 192.168.10.102.
I have an Windows end-user on OPT1 in 192.168.20.9, with it's gateway to my squid so 192.168.20.105.

I'm trying to ssh my infra server on 192.168.10.107 from my host on 192.168.20.9 without being able to.
I can see that my server 192.168.10.107 receives packets and answers to them:

14:16:26.434519 IP 192.168.20.9.57691 > myserver.ssh: Flags [S], seq 3154545065, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:16:26.434537 IP myserver.ssh > 192.168.20.9.57691: Flags [S.], seq 3458918325, ack 3154545066, win 32120, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

Here it's routes:

root@myserver:~# ip r
default via 192.168.10.102 dev eth0 proto static
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.107

Somehow, even then I allowed all on my LAN interface in pfSense,

My traffic is blocked and then dropped:

Do you have any ideas why this behavior ?

EDIT:
Even when I add rule via EasyRule (+ button next to my blocked traffic), allow all destination port then apply, rule is not matched. Traffic is still dropped.

viragomann

@Blebitu said in PfSense Rule ignored on TCP when communication happens between two directly connected networks:

I have an Windows end-user on OPT1 in 192.168.20.9, with it's gateway to my squid so 192.168.20.105.

If the proxy is within the same subnet and works in transparent mode, you will run into asymmetric routing issues for sure.

johnpoz

Yeah as @viragomann points out - seeing blocks for SA screams asymmetrical traffic.

Blebitu

Okay thanks for the answers !
My proxy is indeed within the same subnet and works in transparent mode.
I have to add static routes on my squid proxy then ? When trying to reach my 192.168.10.0/24 network ?
Or should I add static routes on my pfSense straight away ?

Anyway I'm gonna look in this asymmetric routing issue :)

johnpoz

@Blebitu routes are most likely not going to help..

Running anything internally that routes/proxies or vpn sort of connection vs at the edge is going to be problematic with how the data flows, especially with a stateful firewall. And the new change to interface bound states with 24.03, your more likely to see such issues with asymmetrical flow not working how the user expects it too.

If you send traffic to X, but the answer comes back via Y your going to have problems with a stateful firewall. So in the blocks you show.. Pfsense never saw the syn from 20.9 to 10.107 on port 22.. But it does see the syn,ack from 10.107 to 20.9.. And says hey wait a minute I don't have state for this.. Not going to allow this traffic.

viragomann

@Blebitu
Disable the transparent mode in the proxy or redesign your network and put the proxy into a separate network segment and redirect all traffic from the clients to it for filtering.

johnpoz

I would concur using it as explicit proxy where your devices actual gateway points to pfsense vs the proxy should remove such issues what what your seeing with that 22 traffic you listed.

Other option with putting such devices that are really internal to your network on their own transit network can eliminate asymmetrical flow issues.