Block 1 IP client while on LTE Wan Backup interface
-
@iptvcld and again that block, your third rule should not have a gateway on it.. Did you check the box I showed you in screen shot? If not if wan pppoe goes down, then the rule will just be there without the gateway in rule 2 and would allow access through whatever gateway is up.
Why do you have another alias, for dns shouldn't it just point to pfsense lan IP? So just use the built in alias lan address.
-
@johnpoz yes, I checked that box you mentioned as well. And for the 3rd rule, I will remove the gateway as you right, it’s just a redundant option since it’s a block all rule anyways for that alias.
As for the DNS Server alias, I have 2 DNS servers (nextDNS) that I am self hosting on a Ubuntu container and those are are listening on port 53. So in pfsense, I have those 2 dns server IPs for all my dhcp clients to hand out. Pfsense is just doing my local host overrides for my domain.
-
@iptvcld ah ok so these dns servers are on some different vlan/network than this lan network.. Because if they are on the network the client is on, they would never go through pfsense to get to them.
Make sure you actually test that this works how you want it to work before you call it done ;)
edit:
On a bit of side note there was another thread today about someone sucking up their whole LTE quota 2GB in like 20 days without even moving data over it.. Do you have such a quota?Thinking about it - there might be quite a few people that have such lte backups and background traffic might be eating through their quota and either when they do need it they only have small amount left, and if they go over they get charged or dropped to a slower tier..
-
@johnpoz sorry can you explain a bit more on this?
if they are on the network the client is on, they would never go through pfsense to get to them.My DNS servers are on the MGMT vlan/network 10.200.x.x and my lan is on 192.168.x.x. So if my dns server was in my lan network, why would they never go through pfsense? Your saying they would just talk directly to the dns servers? What about my MGMT clients I have now? They are bypassing pfsense? Is this a bad thing? If I had rules set for MGMT clients, when they all be bypassed?
-
@iptvcld Why would you think that some device on 192.168.1.x/24 would need to send traffic to pfsense to go to 192.168.1.y/24
A gateway is to get off a network, when a client wants to talk to an IP - oh that is on my network, arp and send it the mac address I get back.. When the IP is not on their network.. Oh need to send this my default gateway or some gateway I have a route for to get to that network.. Arp for the mac of that gateways IP and send the traffic to the gateway..
So yeah if your dns server was the same network as the device wanting to ask the dns server something, no it wouldn't send anything to pfsense the gateway/router to get off the network to some other network.
-
@johnpoz and is this a negative thing? If it does not need to pass through pfsense? Would the rules still be processed for the clients that are on the same network as the dns servers?
-
@iptvcld No the rule would never see traffic, it would never trigger.. Not sure what your not grasping that client doesn't send traffic to pfsense if the what it wants to talk to is on the same network as it..
Is it a negative thing? Lack of understanding the basic concept sure.. Traffic never gets sent to the gateway when devices talk amongst themselves on the same network.. Not grasping this concept leads to users creating rules that would never ever trigger and never be used.. When they do that and do not understand this concept, it leads to not understanding why something isn't working or is even though they are blocking it per how they think the rules work.. This is the big "negative" if you will.
-
@johnpoz understood, but this should be ok as the clients on the network where the dns servers are would just bypass pfsense for the purpose of resolving DNS. Once they resolve the address via DNS and need to exit in order to access the internet, they will come back to pfsense.
-
@iptvcld yeah.. To get off your local network, you have to talk to some router that will route that traffic for you - ie pfsense.
-
@johnpoz thanks again and sorry if it takes me a bit long to grasp. I enjoy playing with my home lab tech and I am learning a ton on the way from this community and people like you.
-
@iptvcld No problem - happy to help.. The only thing that gets frustrating sometimes, is man just answered the same exact question 3 days ago ;) does nobody know how to search a forum or even browse a few pages of threads... I get it sometimes understanding the search term can be a problem..
But I do not recall such a question, at least not any time recent..
So when you get a chance I would fully test that his works exactly how you want.. I would for example pull the plug on your pppoe connection and make sure your other clients work over your lte connection except for this one client your wanting to block..
