Firewall rule blocking access to pfsense gui not working (IPv6 global unicast getting through)

[ddbnj]

I honestly thought I knew IPv6 enough but I was wrong.

I have a guest network setup with the following rules:

PFsensePorts are the GUI ports and 22 for SSh
DNS_ports are 53 and 853
RCF1918 contains private IPv4 ranges and fd00::/8

When checking states, my guest user can access the GUI via 2600:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx

I don't have a fixed IPv6 prefix, although I don't know when it changed last so I don't have any GUA specific rules. My concern is that if the address supplied by my ISP changes, the rules would no longer work and I wouldn't be aware.

How can I block traffic from accessing the pfsense GUI via a dynamically assigned GUA?

Thanks,

Devan

[SteveITS]

@ddbnj pfSense has a This Firewall alias which should cover all IPs on it.

[dotdash]

This post is deleted!

[ddbnj]

@SteveITS Thats a very valuable tidbit of info. Do you know where I can find a list of similar aliases?

[SteveITS]

@ddbnj It's probably in the docs somewhere. That one shows when adding a rule. There's an alias for each pfSense network/subnet plus This Firewall.