Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall review

    Scheduled Pinned Locked Moved Firewalling
    35 Posts 5 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jarhead @Antibiotic
      last edited by

      @Antibiotic LAN Subnets can't be a source on the WAN.

      A 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @Antibiotic
        last edited by Gertjan

        @Antibiotic

        Is the first image the LAN, and the second image the WAN ?
        The other way around ?

        edit : I get it : the second is LAN.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        A 1 Reply Last reply Reply Quote 0
        • A
          Antibiotic @Gertjan
          last edited by Antibiotic

          @Gertjan Should second rule set exactly on WAN interface or it's ok with invert?

          pfSense plus 24.11 on Topton mini PC
          CPU: Intel N100
          NIC: Intel i-226v 4 pcs
          RAM : 16 GB DDR5
          Disk: 128 GB NVMe
          Brgds, Archi

          1 Reply Last reply Reply Quote 0
          • A
            Antibiotic @Jarhead
            last edited by

            @Jarhead Should be set on WAN interface?

            pfSense plus 24.11 on Topton mini PC
            CPU: Intel N100
            NIC: Intel i-226v 4 pcs
            RAM : 16 GB DDR5
            Disk: 128 GB NVMe
            Brgds, Archi

            GertjanG J 2 Replies Last reply Reply Quote 0
            • GertjanG
              Gertjan @Antibiotic
              last edited by

              @Antibiotic

              On WAN, you can throw everything away.

              Or : explain what you want rule 1 and 2 to do ?

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              A 1 Reply Last reply Reply Quote 0
              • A
                Antibiotic @Gertjan
                last edited by Antibiotic

                @Gertjan First rule restrict ports to use in local subnets (between LAN OPT1 OPT2 and etc), second restrict ports use outside to world ( from local subnets to internet)

                pfSense plus 24.11 on Topton mini PC
                CPU: Intel N100
                NIC: Intel i-226v 4 pcs
                RAM : 16 GB DDR5
                Disk: 128 GB NVMe
                Brgds, Archi

                GertjanG 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @Antibiotic
                  last edited by

                  @Antibiotic

                  Rules apply on traffic that goes INTO the interface only.

                  A rule like this :

                  d4e2431e-d2c3-4a99-a091-63b5a6d730f4-image.png

                  (I presume you already removed the "LAN subnets" from Source)

                  is placed on an interfact that can never have IP addresses you've placed in "local_subnets".

                  Golden rule : RFC1918 is not routed over the Internet. So traffic that comes into your WAN contains as a destination IP : your WAN IP and nothing else.

                  ......

                  The first image is a copy of the bottom part of the second image ..... 😞
                  Can you redo the images svp ?

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  A 3 Replies Last reply Reply Quote 0
                  • A
                    Antibiotic @Gertjan
                    last edited by

                    @Gertjan said in Firewall review:

                    Can you redo the images svp ?

                    What this svp?

                    pfSense plus 24.11 on Topton mini PC
                    CPU: Intel N100
                    NIC: Intel i-226v 4 pcs
                    RAM : 16 GB DDR5
                    Disk: 128 GB NVMe
                    Brgds, Archi

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • A
                      Antibiotic @Gertjan
                      last edited by

                      @Gertjan said in Firewall review:

                      Golden rule : RFC1918 is not routed over the Internet. So traffic that comes into your WAN contains as a destination IP : your WAN IP and nothing else.

                      I want to restrict ports use not ip addresses

                      pfSense plus 24.11 on Topton mini PC
                      CPU: Intel N100
                      NIC: Intel i-226v 4 pcs
                      RAM : 16 GB DDR5
                      Disk: 128 GB NVMe
                      Brgds, Archi

                      1 Reply Last reply Reply Quote 0
                      • J
                        Jarhead @Antibiotic
                        last edited by

                        @Antibiotic The firewall applies rules to traffic coming into the interface from the attached network.
                        If you want to block a PC on the LAN from accessing anything else, the rule goes on the LAN interface.
                        If you want to block all traffic from the Internet, the rule goes on the WAN. Keep in mind there is a default Block All on all interfaces, but it's a hidden rule. So no rules on an interface means everything is blocked coming in to that interface.

                        A 2 Replies Last reply Reply Quote 0
                        • A
                          Antibiotic @Jarhead
                          last edited by

                          @Jarhead said in Firewall review:

                          default Block All on all interfaces

                          Block all to pfsense and allow all from pfsense? is it correct?

                          pfSense plus 24.11 on Topton mini PC
                          CPU: Intel N100
                          NIC: Intel i-226v 4 pcs
                          RAM : 16 GB DDR5
                          Disk: 128 GB NVMe
                          Brgds, Archi

                          1 Reply Last reply Reply Quote 0
                          • A
                            Antibiotic @Jarhead
                            last edited by

                            @Jarhead said in Firewall review:

                            coming in

                            I want to use ports which me allow coming out not come in

                            pfSense plus 24.11 on Topton mini PC
                            CPU: Intel N100
                            NIC: Intel i-226v 4 pcs
                            RAM : 16 GB DDR5
                            Disk: 128 GB NVMe
                            Brgds, Archi

                            J 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Antibiotic
                              last edited by

                              @Antibiotic said in Firewall review:

                              What this svp?

                              That's local language for S'il vous plait, or "Please".

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              A T 2 Replies Last reply Reply Quote 0
                              • A
                                Antibiotic @Gertjan
                                last edited by

                                @Gertjan Ok my friend, so suspect my rules were incorrect))))
                                I did default:
                                a2b6a159-9621-4990-9576-5f93e082c4be-image.png

                                And will searching how to make in correct way, what I want.

                                Fisrt rule restrict ports using only, what me allow to use inside local subnets
                                Second rule restrict ports using, what me allow to use outside local subnets to internet. I do not know for this moment, how to make this correct, will search examples with a images by words difficult to imaging.

                                pfSense plus 24.11 on Topton mini PC
                                CPU: Intel N100
                                NIC: Intel i-226v 4 pcs
                                RAM : 16 GB DDR5
                                Disk: 128 GB NVMe
                                Brgds, Archi

                                JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                • J
                                  Jarhead @Antibiotic
                                  last edited by

                                  @Antibiotic said in Firewall review:

                                  @Jarhead said in Firewall review:

                                  default Block All on all interfaces

                                  Block all to pfsense and allow all from pfsense? is it correct?

                                  You're not understanding still. All traffic is evaluated "entering" the interface that network is attached to.
                                  So yes, block all to pfSense if you wanna say it that way, but not allow all from pfSense because it depends on where that traffic is coming from.
                                  If it's from another interface on pfSense and blocked on that interface, it wouldn't be allowed from pfSense.

                                  @Antibiotic said in Firewall review:

                                  @Jarhead said in Firewall review:

                                  coming in

                                  I want to use ports which me allow coming out not come in

                                  So then you have to block or allow the traffic on the interface attached to pfSense.
                                  If you have a pc on OPT1, and you want to block it's traffic to the LAN, you put the block rule on OPT1. That blocks that pc's out as you're calling it.
                                  So you have to think about what each interface, or device, can access, and create rules to do that.

                                  A 2 Replies Last reply Reply Quote 0
                                  • A
                                    Antibiotic @Jarhead
                                    last edited by

                                    @Jarhead said in Firewall review:

                                    If it's from another interface on pfSense and blocked on that interface, it wouldn't be allowed from pfSense

                                    When you install pfsense this one is default rule on LAN
                                    7a0b112b-00fd-48f6-8759-f41079aaeb19-image.png

                                    Sorry protocol also any , it mean all allow out from interface LAN

                                    pfSense plus 24.11 on Topton mini PC
                                    CPU: Intel N100
                                    NIC: Intel i-226v 4 pcs
                                    RAM : 16 GB DDR5
                                    Disk: 128 GB NVMe
                                    Brgds, Archi

                                    J 1 Reply Last reply Reply Quote 0
                                    • A
                                      Antibiotic @Jarhead
                                      last edited by Antibiotic

                                      @Jarhead said in Firewall review:

                                      So then you have to block or allow the traffic on the interface attached to pfSense.

                                      tHAT WJY , ME ASKING CORRECT EXAMPLE TO ALLOW ONLY PORTS WHAT ME WANT TO COMMUNICATE ON SUBNETS AND COMMUNICATE WITH INTERNET. DO NOT HAVE A BIG EXPIRIENCE ,THAT ALL WHAT I WANT

                                      pfSense plus 24.11 on Topton mini PC
                                      CPU: Intel N100
                                      NIC: Intel i-226v 4 pcs
                                      RAM : 16 GB DDR5
                                      Disk: 128 GB NVMe
                                      Brgds, Archi

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        Jarhead @Antibiotic
                                        last edited by

                                        @Antibiotic It means allow all traffic from the LAN subnet to anywhere it wants to go.
                                        Once traffic is allowed into the firewall, it can then go anywhere.

                                        Don't know how else to say this, traffic is either allowed or blocked as it enters the interface from the network directly attached to that interface.
                                        If you're LAN is 192.168.1.0/24 and you have a pc at 192.168.1.2, and you want to block it from accessing the internet, you put the rule on the LAN interface, not the WAN.

                                        A 2 Replies Last reply Reply Quote 0
                                        • A
                                          Antibiotic @Jarhead
                                          last edited by

                                          @Jarhead said in Firewall review:

                                          from accessing the internet

                                          i DO NOT WANT TO BLOCK INTERNET, JUST WANT TO RESTRICT TO PORTS NUMBERS WIHCH I WANT

                                          pfSense plus 24.11 on Topton mini PC
                                          CPU: Intel N100
                                          NIC: Intel i-226v 4 pcs
                                          RAM : 16 GB DDR5
                                          Disk: 128 GB NVMe
                                          Brgds, Archi

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            Antibiotic @Jarhead
                                            last edited by

                                            @Jarhead said in Firewall review:

                                            you put the rule on the LAN interface, not the WAN.

                                            My friend if you have a time and desire can you please just simple show 2 examples
                                            First allow only ports to use by local subnets which you set in your aliases

                                            Second allow to communicate with internet outside of pfsense with ports which you set in second aliases

                                            pfSense plus 24.11 on Topton mini PC
                                            CPU: Intel N100
                                            NIC: Intel i-226v 4 pcs
                                            RAM : 16 GB DDR5
                                            Disk: 128 GB NVMe
                                            Brgds, Archi

                                            J 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.